# If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?

The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would this cause? Would it be easier to find collisions, preimages, etc? Would it be possible to insert backdoors?

So far, I've only found one example, as specified here (Using SHA-256 with different initial hash value):

However, allowing an arbitrary IV renders ineffective one of the two redundant safeguards built into SHA-2's padding scheme. If the message length was removed from the above padding scheme, then an adversary having the ability to decide the different IV could do so nefariously; in particular, such that he knows a secret backdoor block $$B$$ that can be inserted at the beginning of any message, leaving the hash invariant. Proof: one round of SHA-2 transforms the state $$S$$ according to $$S_{j+1}=F(M_j,S_j)\hat+S_j$$, where $$F$$ is a cipher with the (padded) message block $$M_j$$ used as key, $$\hat+$$ is addition with some carries suppressed, and $$S_0$$ is the IV we are discussing. One able to choose the IV could choose it as $$F^{-1}(B,0)$$, thus such that $$F(B,\mathtt{IV})=0$$, thus such that $$M_0=B\implies S_1=S_0$$.

Are there any other examples of potential weaknesses/attacks that would ensue if I allow the attacker to choose arbitrary IVs for the SHA256 hash function?

• If you're looking for a way to create new hash functions, then you have options other than inventing your own algorithm. Some newer hash algorithms have a "context", "domain", or "personalization" string as an optional parameter, specifically for that purpose. (So there is no issue with using the same or related input with two instances of the hash algorithm with different context strings. Nor any relation in the corresponding outputs.) Salting gets you something kind of similar. Implementations of these things sometimes sub IV values as an optimization. (But the IV is not totally arbitrary) – Future Security Mar 28 at 22:03
• Malicious SHA-1 "We show that systems using 'custom' versions of SHA-1 may include backdoors exploitable by the designers. Such custom versions of cryptographic standards are typically found in proprietary systems as a way to personalize the cryptography for a given customer" They claim "To third party analysis, malicious SHA-1 remains as strong as the original SHA-1: the backdoor is 'undiscoverable', it can only be exploited by the [party choosing the IV]." You can probably pick IVs that ARE exploitable by everyone. SHA-1 is bad. – Future Security Mar 28 at 23:00