# Are there any security issues when replacing the SHA-256 initialisation values?

As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words.

These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight prime numbers:

H(0)0 = 6a09e667
H(0)1 = bb67ae8
H(0)2 = 3c6ef372
H(0)3 = a54ff53a
H(0)4 = 510e527f
H(0)5 = 9b05688c
H(0)6 = 1f83d9ab
H(0)7 = 5be0cd19


These are obviously meant to be "nothing up my sleeves" numbers.

Assuming interoperability — read: compatibility between users — isn't an issue, I've got the following questions:

1. Are there any security issues related to replacing those SHA-256 initialisation values?

The plan is the one-time use of a CSPRNG to get alternative values for a specific (in-house) implementation; which I presume to be a safe way to get good alternative values. Please correct me when this assumption is wrong.

2. Are some initialisation values worse than others?

In other words: is the Merkle–Damgård construction, and/or the SHA-2 algorithm design as a whole, susceptible to weak initialisation values along the lines of 0-key problems as applicable to cipher analysis? Or could we set them all to zero without any impact on cryptographic security?

NB: pointers to related research paper(s) welcome, but not a "must".

• If there was an attack, even only a collision, we'd call it a free-start collision. (related reading) But because we don't know of any SHA-256 free-start collisions, I suspect it's fine replacing these values. – SEJPM Mar 11 '17 at 14:22
• Related: Malicious SHA-1 – CodesInChaos Mar 11 '17 at 16:25
• @CodesInChaos Tnx for the pointer. Makes me think, but I’m not sure if I should worry about that (especially the differential characteristic part) or not (since SHA-1 is a bit different from SHA-2). Do you think this could also be "ported over" to SHA-2 and have a practical impact on cryptographic security? I’m inclined to say “no” (due to the effort needed to find exploitable 64-step characteristics), but I’ld like to be sure I’m not dropping the ball somewhere. – e-sushi Mar 11 '17 at 17:55
• @SEJPM Variable IVs as mentioned in the linked answer would indeed be an issue, but as my Q mentions – we’re merely talking about a one-time-only replacement. After that, the IVS will stay fixed as part of a compiled binary. – e-sushi Mar 12 '17 at 0:56
• Since 10+ comments were posted (thanks for all that feedback); I moved things to chat where we have a bit more room to breathe, while keeping the Q&A here as readable as possible. – e-sushi Mar 12 '17 at 1:25