At the start of each of the SHA-0 through -2 algorithms, the initial state is set to certain constants. I'm curious where the initialization values in SHA-224 are from.
- MD5's initial values are simple increasing and decreasing patterns of hex digits.
- SHA-0's and SHA-1's values are the same as MD5's with one additional value that is also a simple hex digit pattern.
- SHA-256's values are the fractional bits of the square roots of primes $2$~$19$.
- SHA-384's values are the fractional bits of the square roots of primes $23$~$53$.
- SHA-512's values are SHA-256's values expanded out to 64 bits.
But what are SHA-224's initialization constants from? They're the only one in the SHA family that I can't find the source of. They're also not simply the square root of primes $23$~$53$ like you might expect.