# Origin of the SHA-224 initial hash value?

At the start of each of the SHA-0 through -2 algorithms, the initial state is set to certain constants. I'm curious where the initialization values in SHA-224 are from.

• MD5's initial values are simple increasing and decreasing patterns of hex digits.
• SHA-0's and SHA-1's values are the same as MD5's with one additional value that is also a simple hex digit pattern.
• SHA-256's values are the fractional bits of the square roots of primes $2$~$19$.
• SHA-384's values are the fractional bits of the square roots of primes $23$~$53$.
• SHA-512's values are SHA-256's values expanded out to 64 bits.

But what are SHA-224's initialization constants from? They're the only one in the SHA family that I can't find the source of. They're also not simply the square root of primes $23$~$53$ like you might expect.

• Note that the origin of the round constants of SHA-224 are known; they're the same as SHA-256's, and they're the fractional part of the cube root of prime numbers. It's the initial hash value that I'm interested in (initial values of variables a~h). Dec 17 '16 at 5:23
• For an explanation of the philosophy behind choosing many of these numbers, see the concept of nothing up my sleeve numbers. Dec 18 '16 at 5:23
• The provenance for these values is listed in the Wikipedia article for SHA-2 Dec 20 '16 at 9:14

The SHA-224 initial values are the second 32 bits of the fractional parts of the square roots of the 9th through 16th primes (namely, 23 through 53), or in other words, $\lfloor 2^{64} \sqrt{p} \rfloor \bmod 2^{32}$, for $p = 23, 29, 31, 37, 41, 43, 51, 53$
For example, the hex expansion of $\lfloor 2^{64} \sqrt{23} \rfloor = 4cbbb9d5dc1059ed8_{16}$, and so the initial value for $a$ is the last 8 hex digits, namely $c1059ed8_{16}$
Similarly, the hex expansion of $\lfloor 2^{64} \sqrt{29} \rfloor = 5629a292a367cd507_{16}$, and so the initial value for $b$ is $367cd507_{16}$