# Using SHA-256 with different initial hash value

FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value (for example: a random salt)? Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value.

-
"Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value." Not quite, the appended message length would be off by a few bytes. –  Thomas Oct 3 '12 at 13:45
What would be the benefits? –  Stephen Touset Sep 5 '14 at 5:08
@StephenTouset the benefit would be essentially the same as HMAC/NMAC provides, which is to change that initial hash value using a key –  Richie Frame Sep 5 '14 at 8:42
Why not simply use HMAC or NMAC, then, which have security proofs? –  Stephen Touset Sep 5 '14 at 17:30
NMAC/HMAC literally just hashes the key first to create the initial value, instead of using the key directly, and does it with 2 different keys in a wrapped structure. The security proofs require the hash to be a secure PRF, which is not completely fulfilled in practice. –  Richie Frame Sep 5 '14 at 19:45

However, allowing an arbitrary IV renders ineffective one of the two redundant safeguards built into SHA-2's padding scheme. If the message length was removed from the above padding scheme, then an adversary having the ability to decide the different IV could do so nefariously; in particular, such that he knows a secret backdoor block $B$ that can be inserted at the beginning of any message, leaving the hash invariant. Proof: one round of SHA-2 transforms the state $S$ according to $S_{j+1}=F(M_j,S_j)\hat+S_j$, where $F$ is a cipher with the (padded) message block $M_j$ used as key, $\hat+$ is addition with some carries suppressed, and $S_0$ is the IV we are discussing. One able to choose the IV could choose it as $F^{-1}(B,0)$, thus such that $F(B,\mathtt{IV})=0$, thus such that $M_0=B\implies S_1=S_0$.