3
$\begingroup$

At the start of each of the SHA-0 through -2 algorithms, the initial state is set to certain constants. I'm curious where the initialization values in SHA-224 are from.

  • MD5's initial values are simple increasing and decreasing patterns of hex digits.
  • SHA-0's and SHA-1's values are the same as MD5's with one additional value that is also a simple hex digit pattern.
  • SHA-256's values are the fractional bits of the square roots of primes $2$~$19$.
  • SHA-384's values are the fractional bits of the square roots of primes $23$~$53$.
  • SHA-512's values are SHA-256's values expanded out to 64 bits.

But what are SHA-224's initialization constants from? They're the only one in the SHA family that I can't find the source of. They're also not simply the square root of primes $23$~$53$ like you might expect.

$\endgroup$
  • $\begingroup$ Note that the origin of the round constants of SHA-224 are known; they're the same as SHA-256's, and they're the fractional part of the cube root of prime numbers. It's the initial hash value that I'm interested in (initial values of variables a~h). $\endgroup$ – Myria Dec 17 '16 at 5:23
  • $\begingroup$ For an explanation of the philosophy behind choosing many of these numbers, see the concept of nothing up my sleeve numbers. $\endgroup$ – Luis Casillas Dec 18 '16 at 5:23
  • $\begingroup$ The provenance for these values is listed in the Wikipedia article for SHA-2 $\endgroup$ – Richie Frame Dec 20 '16 at 9:14
7
$\begingroup$

The SHA-224 initial values are the second 32 bits of the fractional parts of the square roots of the 9th through 16th primes (namely, 23 through 53), or in other words, $\lfloor 2^{64} \sqrt{p} \rfloor \bmod 2^{32}$, for $p = 23, 29, 31, 37, 41, 43, 51, 53$

For example, the hex expansion of $\lfloor 2^{64} \sqrt{23} \rfloor = 4cbbb9d5dc1059ed8_{16}$, and so the initial value for $a$ is the last 8 hex digits, namely $c1059ed8_{16}$

Similarly, the hex expansion of $\lfloor 2^{64} \sqrt{29} \rfloor = 5629a292a367cd507_{16}$, and so the initial value for $b$ is $367cd507_{16}$

Note that the SHA-224 initial values are the lower 32 bits of the SHA-384 initial values (!).

$\endgroup$
  • $\begingroup$ Ah, I didn't catch that they matched the low dword of the SHA-384 constants. Thanks! $\endgroup$ – Myria Dec 19 '16 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.