# Why the $IV$ used in Merkle–Damgård has to be fixed to a specific value?

I just can't figure out why on earth the $IV$ in Merkle–Damgård has to be fixed (that's what the Katz-Lindell book says)? Because even if you choose it randomly from say $\{{0,1}\}^n$ then the resulting construction still remains collision-resistant, or not?

• One reason is convenience: a variable IV would need to be transmitted, perhaps authenticated.. Another reason is explained here following with the IV replaced by a constant of unknown origin – fgrieu Aug 23 '15 at 14:27
• @fgrieu If you'll add your comment as an answer, I'll accept it. Thank you btw – pa5h1nh0 Aug 23 '15 at 23:28

Notice that the compression function $C$ used in these hashes is of the form $$(X,K)\rightarrow C(X,K)=X\tilde+ E(X,K)$$ where $X$ is the current state (initially the IV), $K$ is the block to hash, $\tilde+$ is a variant of addition (with a few carries suppressed), and $X\rightarrow E(X,K)$ is a reversible block cipher with key $K$.
Who defined an $IV$ that's not a nothing-up-my-sleeves number could have chosen a secret one-block $K$, computed $IV = E^{-1}(0,K)$, which insures $IV=C(IV,K)$. That allows insertion of $K$ at the beginning of any message, without changing the hash.