Hash initialization vector ($\mathrm{IV}$)

A hash initialization vector is the initial internal state from which a specified cryptographic hash function begins processing a message. For the SHA-2 algorithms, it is a public, algorithm-defined sequence of state words. It is not a fresh per-message cryptographic nonce, a secret key or a cryptographic salt.^[ref]

For an iterative hash, write the state update schematically aswhere $M_i$ is one padded message block and $C$ is the algorithm's hash compression function. The digest is derived from the final state by the algorithm's output rule. Initial state, padding, compression and output rule together specify the function; agreeing on only the output width does not specify a hash.

An original comparison uses two specified algorithms. SHA-256 starts with the 32-bit word 6a09e667, while SHA-224 starts with c1059ed8. Both subsequently use the SHA-256-family compression structure, but their full initial states differ. Even the empty message is padded and processed, so its digest is not simply a printed initial state.^[ref]

Computing the empty-message digests gives SHA-256

and SHA-224

d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f.

Keeping the first 28 bytes of the first result does not produce the second. Initialization acts before every subsequent block transformation; final truncation cannot substitute for it.

This also matters when implementing several hash variants with one compression routine. Resetting a context must restore the chosen variant's complete initial state and length counters. Accidentally reusing a previous message's final state computes a different function. A known-answer test for empty and short messages can expose such state-management mistakes, although passing finitely many vectors does not prove every update sequence correct.