= SHA-512/224
{c}
{title2=$H(m)\in\{0,1\}^{224}$}
\b[SHA-512/224] is a <SHA-2> <cryptographic hash function> returning 224 bits. It uses the <SHA-512> computation with its own <hash initialization vector> and outputs the first 224 bits of the final state. The <SHA-512 t> initialization procedure uses the ASCII label `SHA-512/224`, so its initial state differs from that of <SHA-512 256> as well as ordinary SHA-512.<Secure Hash Standard by National Institute of Standards and Technology>[§5.3.6.1 and §6.6]{ref}
Output serialization needs care because $224=3\times64+32$. If the final eight 64-bit words are $H_0,\ldots,H_7$, the digest contains
$$
H_0\Vert H_1\Vert H_2\Vert\operatorname{left}_{32}(H_3),
$$
where $\Vert$ denotes <concatenation> in the standard's most-significant-bit-first order. It has 28 bytes, or 56 <hexadecimal> digits. For a simple serialization example, if $H_3$ were `89abcdef01234567`, its contribution would be the four bytes `89 ab cd ef`. Taking the four bytes `01 23 45 67` would keep the wrong half. An implementation's machine <endianness> does not change the specified digest bytes.
For a computed example, hashing ASCII bytes `61 62 63` gives
`4634270f707b6a54daae7530460842e20e37ed265ceee9a43e8924aa`.
<SHA-224> of the same bytes begins `23097d223405d822`, despite having the same 224-bit output size. The two functions use different compression structures, initial states and message-padding conventions. Taking a prefix of the ordinary <SHA-512> digest also gives a different result.
The distinction matters in a <cryptographic test vector>: a 28-byte expected digest cannot identify the intended algorithm by its size alone. The vector must name SHA-512/224 and specify the exact input bytes. The different label used during initialization is fixed by the algorithm; applications do not choose it separately for each hash.
Back to article page
