Why does SHA2-224 use different IV's than SHA2-256?

Question

Given that it's otherwise just a truncation, I can guess that being able to compute the 224 value from the 256 value is an unwanted property, but that's just speculation.

Answer 1

The $\operatorname{SHA-224}$ is defined in the exact same manner as $\operatorname{SHA-256}$ with different initial values and the digest is obtained truncating the hash value, FIPS PUB 180-4 Page 23.

The different initial value provides domain separation. With domain separation $$\operatorname{SHA-224}(m) \neq \operatorname{SHA-256}(m)|_{224}$$ where $|_{224}$ is the truncation. If the IV's would be the same then the truncated values would be the same as the initial bits of the full hash, breaking domain separation.

A nice definition of domain separation can be found Hashing to Elliptic Curves, ietf draft

Cryptographic protocols that use random oracles are often analyzed under the assumption that random oracles answer only queries generated by that protocol. In practice, this assumption does not hold if two protocols query the same random oracle. Concretely, consider protocols $P1$ and $P2$ that query random oracle $R$: if $P1$ and $P2$ both query $R$ on the same value $x$, the security analysis of one or both protocols may be invalidated.

A common approach to addressing this issue is called domain separation, which allows a single random oracle to simulate multiple, independent oracles. This is effected by ensuring that each simulated oracle sees queries that are distinct from those seen by all other simulated oracles. For example, to simulate two oracles $R1$ and $R2$ given a single oracle $R$, one might define

$$R1(x) := R(\text{"R1"} \mathbin\| x)$$ $$R2(x) := R(\text{"R2"} \mathbin\| x)$$

In this example, $\text{"R1"}$ and $\text{"R2"}$ are called domain separation tags; they ensure that queries to $R1$ and $R2$ cannot result in identical queries to $R$. Thus, it is safe to treat $R1$ and $R2$ as independent oracles.

A random oracle is like a kind of hash function and the same concept applies to hash functions.

The initial values required to be a nothing-up-my-sleeve numbers to eliminate the suspicion of hidden properties, though that is psychological.

Similar to $\operatorname{SHA-224}$,

• $\operatorname{SHA-384}$ is a truncation of $\operatorname{SHA-512}$ with different initial values.
• $\operatorname{SHA-512/256}$ is a truncation of $\operatorname{SHA-512}$ with different initial values.
• $\operatorname{SHA-512/224}$ is a truncation of $\operatorname{SHA-512}$ with different initial values.

As a side note; the truncation, naturally, provides resistance to length extension attack.