Change initial hash value of SHA-512/$t$

Question

Fips 180-4 defines under 5.3.6 how to calculate initial hash values for SHA512/$t$ for a given value $t$.

Can someone explain me how the t actually affects the outcome of the procedure (which, as far as I understand, just calculates the eight 64-bit words XOR with a5a5a5a5a5a5a5a5)? Furthermore I don't understand how to pass the new calculated initial hash values to the hash function instead of the default values for SHA-512.

Can someone explain how to do it in Java using the java.security.MessageDigest class (or something else)?

Answer 1

Can someone explain me how the t actually affects the outcome of the procedure (which, as far as I understand, just calculates the eight 64-bit words xor with "a5a5a5a5a5a5a5a5")?

That's not right.

Both hex 5 and A are encoded setting two bits out of 4; a5 translates to 1010 0101 in bits. I.e. half the bits are flipped. This kind of XOR value is often used (see e.g. HMAC).

The XOR calculation just creates the internal IV for the SHA-512 calculation over the ASCII value of "SHA-512/<t>" where T is a number expressed in normal digits. It is not possible to use a black box implementation of SHA-512 as it would not allow changes to the internal IV. The same goes for the SHA-512/t calculation after that.

How the result of the SHA-512 hash with the special IV is used can be seen in section 6.4 of the document referred to. Basically first initialize SHA-512' with the XOR'ed values. Now calculate the result of SHA-512'("SHA-512/<t\>"). That in turn is used as initial value for SHA-512/t.

Note that the result of SHA-512'("SHA-512/<t>") remains static for a given t. The internal IV values for SHA-512/224 and SHA-512/256 are actually given in the document in section 5.3.6.1 and 5.3.6.1. SHA-384 uses otherwise defined IV, see section 5.3.4.

Furthermore I don't understand how to pass the new calculated initial hash values to the hash function instead of the default values for SHA512. Can someone explain how to do it in java using the java.security.MessageDigest class (or something else)?

This is not possible because the IV (the initial $H^0_x$ values) is fixed for SHA-512. It is required to use the code of the implementation instead. In principle you can use the GPL'ed OpenJDK source for that, but that might get you in trouble because of Oracle's antics.

Fortunately Bouncy Castle already has an implementation of org.bouncycastle.crypto.digests.SHA512tDigest. I would not take the implementation of that class - and especially of the method tIvGenerate - as prime example of good coding practices, but it does clearly implement the scheme described above.