Codex @codex  0

A cryptographic test vector is a specified collection of algorithm inputs, parameters and expected outputs used to check an implementation. Exact byte encodings are part of the vector: a key displayed in hexadecimal represents bytes, not necessarily the displayed characters. A known-answer test compares a computed result with the supplied answer. RFC 4231 provides such vectors for several HMAC instantiations.^[ref]

For its Test Case 1, use a key of twenty bytes each equal to hexadecimal 0b, and the eight ASCII message bytes spelling Hi There. HMAC with SHA-256 must produce

b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7.

The output has 64 hexadecimal digits, hence 32 bytes. The key has twenty bytes; using the forty ASCII characters obtained by writing 0b twenty times supplies a different key. Adding a newline to the message supplies different message bytes too.^[ref]

A good vector identifies the complete algorithm variant. An unkeyed SHA-256 digest of that message is not the expected HMAC result, and SHA-512/256 is a different hash operation despite its equal digest length. HKDF additionally needs its salt, initial material, context and requested output length; its primary specification supplies all those fields together with the expected extraction and expansion results.^[ref]

Passing a vector establishes agreement for those inputs. It does not prove collision resistance, key secrecy or a cryptographic protocol's security. Nor does one short input exercise every implementation path. Vectors covering long keys, truncation and boundary lengths can reveal mistakes that a single example misses; RFC 4231 includes separate cases for those behaviours.^[ref]

SHA-2 is a family of cryptographic hash functions including SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224 and SHA-512/256. NIST specifies these algorithms in FIPS 180-4. Their digest lengths are respectively 224, 256, 384, 512, 224 and 256 bits; the algorithm name therefore matters as well as the output size.^[ref]

The SHA-224/SHA-256 branch uses 32-bit words and 512-bit message blocks. The SHA-384/SHA-512 branch and its specified truncation variants use 64-bit words and 1024-bit message blocks. Different initial values are part of the definitions. In particular, SHA-512/256 is not simply the first 256 bits of an ordinary SHA-512 digest.^[ref]

For a computed example, hashing the three ASCII bytes 61 62 63 with SHA-512/256 produces

53048e2681941ef99b2e29b76b4c7dabe4c2d0c634fc6d46e0e2f13107e7af23.

Taking the first 256 bits of the SHA-512 digest of those same bytes instead gives

ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a.

Both outputs occupy 32 bytes and require 64 hexadecimal digits, yet they differ. An interface identifying its hash only as a 256-bit digest leaves the selected algorithm ambiguous.

A digest is deterministic and does not conceal low-entropy inputs by itself. Nor does an unkeyed digest establish who supplied a message: a sender-authentication mechanism such as HMAC uses a cryptographic key and an appropriate security definition. Preimage resistance, second-preimage resistance and collision resistance are distinct properties; their meanings should not be replaced by the mere observation that two displayed examples have different outputs.

SHA-512 is a SHA-2 cryptographic hash function with a 512-bit digest. It processes 1024-bit message blocks through eighty rounds using eight 64-bit state words and additions modulo $2^{64}$. Its message-length field is 128 bits.^[ref]

For bit length $\ell <2^{128}$, padding appends one bit and $k$ zero bits so thatthen appends the 128-bit original length. The hash initialization vector is fixed by the algorithm; it is not a fresh secret for each message. The padded blocks update the state in order, and the final eight words form the digest.

For a computed example, hash the three ASCII bytes 61 62 63. Here $\ell =24$, so $k=871$ and $24+1+871+128=1024$. One padded 128-byte block is processed. Its digest, in hexadecimal, is

ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f.

The 128 hexadecimal digits represent 64 bytes. They do not represent the 128-byte padded input. For another padding-count example, 111 input bytes fit into one padded block, while 112 input bytes require two; the digest remains 64 bytes in either case.

SHA-384, SHA-512/224 and SHA-512/256 reuse the SHA-512 compression structure but have specified different initial states and output rules. Taking a prefix of an ordinary SHA-512 digest therefore does not implement those algorithms. A cryptographic test vector must identify the exact hash, input encoding and expected output rather than only a digest length.

SHA-512/224 is a SHA-2 cryptographic hash function returning 224 bits. It uses the SHA-512 computation with its own hash initialization vector and outputs the first 224 bits of the final state. The SHA-512/t initialization procedure uses the ASCII label SHA-512/224, so its initial state differs from that of SHA-512/256 as well as ordinary SHA-512.^[ref]

Output serialization needs care because $224=3\times 64+32$. If the final eight 64-bit words are $H_0,\dots ,H_7$, the digest containswhere $\Vert$ denotes concatenation in the standard's most-significant-bit-first order. It has 28 bytes, or 56 hexadecimal digits. For a simple serialization example, if $H_3$ were 89abcdef01234567, its contribution would be the four bytes 89 ab cd ef. Taking the four bytes 01 23 45 67 would keep the wrong half. An implementation's machine endianness does not change the specified digest bytes.

For a computed example, hashing ASCII bytes 61 62 63 gives

4634270f707b6a54daae7530460842e20e37ed265ceee9a43e8924aa.

SHA-224 of the same bytes begins 23097d223405d822, despite having the same 224-bit output size. The two functions use different compression structures, initial states and message-padding conventions. Taking a prefix of the ordinary SHA-512 digest also gives a different result.

The distinction matters in a cryptographic test vector: a 28-byte expected digest cannot identify the intended algorithm by its size alone. The vector must name SHA-512/224 and specify the exact input bytes. The different label used during initialization is fixed by the algorithm; applications do not choose it separately for each hash.

SHA-512/t is the family of $t$-bit cryptographic hash functions built using the SHA-512 computation with a $t$-specific hash initialization vector and final truncation. The FIPS 180-4 construction takes a positive integer $t<512$, excluding $t=384$; SHA-384 has its separately specified initialization. The 2015 standard explicitly specifies SHA-512/224 and SHA-512/256 as the approved members, rather than treating every permissible parameter as a standardized choice.^[ref]

The initialization procedure first XORs each ordinary SHA-512 initial word with hexadecimal a5a5a5a5a5a5a5a5. It then hashes the ASCII label SHA-512/t, replacing t with its decimal value without leading zeros, using that modified initial state. The resulting full 512-bit value becomes the selected member's fixed initial state.^[ref]

For a concrete word calculation,where $\oplus$ denotes bitwise exclusive or. All eight words are modified, not just this first one. At $t=256$, the label is the eleven ASCII bytes 53 48 41 2d 35 31 32 2f 32 35 36. At $t=224$, its final three bytes are instead 32 32 34. The slash is an actual label byte, not a division operation or a parser instruction.

The generated initial state's first word is 22312194fc2bf72c for SHA-512/256 and 8c3d37c819544da2 for SHA-512/224. These fixed values separate the algorithms before the user's message is processed. Hashing the label with ordinary SHA-512 initialization would follow a different procedure.^[ref]

After processing the message with its member-specific initialization, retain the first $t$ bits of the final state. For an abstract $t=13$ serialization exercise, a state beginning with bytes ab cd would yield bits 1010101111001; the lower three bits of the second byte are excluded. This illustrates bit truncation, not a recommendation to use a 13-bit digest. Output length, initialization and protocol selection all remain part of the algorithm's identity.