This seems odd to me, because there are a lot of resources out there saying that the initializer values of SHA-512 and SHA-384 are the first 64 bits of the fractional parts of the square roots of prime numbers. For SHA-256 and SHA-224, the 32 LSBs or MSBs of those values are used.

But this question came into my mind that what about SHA-512/224? How on earth are 0x8C3D37C819544DA2 and others calculated? And I have searched a lot and ironically, had no luck.

So, how are those calculated?


Those are calculated using the "SHA-512/t IV Generation Function", as described in FIPS-180 (pdf, see 5.3.6), the Secure Hash Standard.

The procedure is to first modify the normal SHA-512 IV, then calculate the hash of a string describing the truncation mode used, and use that as the IV. Those IVs are essentially just predefined hash outputs and so not any particularly nice numbers.

The reason it is done like this is to allow arbitrary truncation lengths below 512 (except 384, which has its own hash which was defined earlier).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.