Wikipedia - SHA-2 says

SHA-224 is identical to SHA-256, except that:

  • the initial variable values h0 through h7 are different, and
  • the output is constructed by omitting h7.

RFC3874 - A 224-bit One-way Hash Function: SHA-224 says

The use of a different initial value ensures that a truncated SHA-256 message digest value cannot be mistaken for a SHA-224 message digest value computed on the same data.

My questions:

  1. Is the above quoted reason the only reason why SHA-224 and SHA-256 use different initial values?

  2. Why is it important to make sure that a SHA-256 message digest value cannot be mistaken for a SHA-224 message digest value?

  3. If we use the same initial values for both hash functions, will the security of either hash function worsen? If yes, how?

  • 7
    $\begingroup$ This is almost certainly a better fit on crypto.SE. $\endgroup$ Oct 2, 2011 at 13:14
  • 1
    $\begingroup$ At least question 2 seems to be off-topic here. After all, it is related to how people use computers and what is convenient for them; not really a TCS question. $\endgroup$ Oct 2, 2011 at 17:21
  • $\begingroup$ Related question on Crypto.SE: crypto.stackexchange.com/questions/3946/… $\endgroup$
    – mikeazo
    May 14, 2013 at 16:42

1 Answer 1

  1. This We called Domain Separation, when we use same algorithm for different output size.
  2. Separation is necessary because if i found two messages which have hash value (SH256), differs only in last octet and then i can publish the hash value as first 7 octet showing i used SHA224. since i already have two messages colliding on SHA224 which i can use later for forgery attack. Using domain separation we can avoid such situation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.