FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value (for example: a random salt)? Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value.

  • $\begingroup$ "Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value." Not quite, the appended message length would be off by a few bytes. $\endgroup$
    – Thomas
    Oct 3, 2012 at 13:45
  • $\begingroup$ What would be the benefits? $\endgroup$ Sep 5, 2014 at 5:08
  • $\begingroup$ @StephenTouset the benefit would be essentially the same as HMAC/NMAC provides, which is to change that initial hash value using a key $\endgroup$ Sep 5, 2014 at 8:42
  • $\begingroup$ Why not simply use HMAC or NMAC, then, which have security proofs? $\endgroup$ Sep 5, 2014 at 17:30
  • 1
    $\begingroup$ NMAC/HMAC literally just hashes the key first to create the initial value, instead of using the key directly, and does it with 2 different keys in a wrapped structure. The security proofs require the hash to be a secure PRF, which is not completely fulfilled in practice. $\endgroup$ Sep 5, 2014 at 19:45

1 Answer 1


With the message padding scheme of SHA-2/SHA-256 as it stands (add one 1 bit, a minimal number of 0 bits so that the overall padded message will end on a block boundary, then the original message length over some fixed number of bits), I know no attack enabled by allowing a different IV.

However, allowing an arbitrary IV renders ineffective one of the two redundant safeguards built into SHA-2's padding scheme. If the message length was removed from the above padding scheme, then an adversary having the ability to decide the different IV could do so nefariously; in particular, such that he knows a secret backdoor block $B$ that can be inserted at the beginning of any message, leaving the hash invariant. Proof: one round of SHA-2 transforms the state $S$ according to $S_{j+1}=F(M_j,S_j)\hat+S_j$, where $F$ is a cipher with the (padded) message block $M_j$ used as key, $\hat+$ is addition with some carries suppressed, and $S_0$ is the IV we are discussing. One able to choose the IV could choose it as $F^{-1}(B,0)$, thus such that $F(B,\mathtt{IV})=0$, thus such that $M_0=B\implies S_1=S_0$.

  • 2
    $\begingroup$ Thanks. I need to read your answer a few times, but this was the kind of insight I was seeking. $\endgroup$
    – ericball
    Oct 3, 2012 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.