= Hash initialization vector
{title2=$\mathrm{IV}$}
A \b[hash initialization vector] is the initial internal state from which a specified <cryptographic hash function> begins processing a message. For the <SHA-2> algorithms, it is a public, algorithm-defined sequence of state words. It is not a fresh per-message <cryptographic nonce>, a secret key or a <cryptographic salt>.<Secure Hash Standard by National Institute of Standards and Technology>[§5.3, setting the initial hash value]{ref}
For an iterative hash, write the state update schematically as
$$
h_0=\mathrm{IV},\qquad h_{i+1}=C(h_i,M_i),
$$
where $M_i$ is one padded message block and $C$ is the algorithm's <hash compression function>. The digest is derived from the final state by the algorithm's output rule. Initial state, padding, compression and output rule together specify the function; agreeing on only the output width does not specify a hash.
An original comparison uses two specified algorithms. <SHA-256> starts with the 32-bit word `6a09e667`, while <SHA-224> starts with `c1059ed8`. Both subsequently use the SHA-256-family compression structure, but their full initial states differ. Even the empty message is padded and processed, so its digest is not simply a printed initial state.<Secure Hash Standard by National Institute of Standards and Technology>[§§5.1.1, 5.3.2–5.3.3 and 6.3]{ref}
Computing the empty-message digests gives SHA-256
`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
and SHA-224
`d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f`.
Keeping the first 28 bytes of the first result does not produce the second. Initialization acts before every subsequent block transformation; final truncation cannot substitute for it.
This also matters when implementing several hash variants with one compression routine. Resetting a context must restore the chosen variant's complete initial state and length counters. Accidentally reusing a previous message's final state computes a different function. A <known-answer test> for empty and short messages can expose such state-management mistakes, although passing finitely many vectors does not prove every update sequence correct.
Back to article page
