# Why are the initial states of hashes functions (like SHA-1) often non-zero?

There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this:

Why are the initial states of hash functions often non-zero?

For most, I have been able to find a clear explanation of where the initial values come from, and they are frequently nothing-up-my-sleeve values. That is, they are chosen precisely because they have no significant structure. However, if that is the case, why can they not be left at zero? Is it simply that a zero initial state is itself too suspicious?

(Other related question: "Initialising Sha-512")

• In general, all zero/one constants is kind of risky, but most things - even with very obvious patterns - are ok. See Salsa20's "expand 32-byte k" for example. – orlp Oct 28 '13 at 15:37