= SHA-512/256
{c}
{title2=$H(m)\in\{0,1\}^{256}$}
\b[SHA-512/256] is a <SHA-2> <cryptographic hash function> with a 256-bit digest. It uses the 1024-bit blocks and 64-bit word operations of <SHA-512>, a variant-specific <hash initialization vector>, and the first 256 bits of the final state. It is one member of <SHA-512 t>.<Secure Hash Standard by National Institute of Standards and Technology>[§5.3.6.2 and §6.7]{ref}
Its initialization illustrates <cryptographic domain separation>. Let $v$ be the eight-word ordinary SHA-512 initial state. First form $\widetilde v$ by applying <bitwise exclusive or> to each word with the hexadecimal word `a5a5a5a5a5a5a5a5`. Run the SHA-512 computation on the ASCII label `SHA-512/256`, using $\widetilde v$ as its initial state. The full 512-bit result is the variant's fixed initial state $v^{(256)}$. This label computation is part of defining the function, not an extra message prefix chosen by its user.<Secure Hash Standard by National Institute of Standards and Technology>[§5.3.6, SHA-512/t IV Generation Function]{ref}
If $\operatorname{SHA512}^{v^{(256)}}(m)$ denotes the full final state obtained by hashing $m$ with that initialization, then
$$
H_{512/256}(m)=\operatorname{left}_{256}\!\left(\operatorname{SHA512}^{v^{(256)}}(m)\right).
$$
The output comprises four 64-bit words: 32 bytes or 64 <hexadecimal> digits. The initial state is public and fixed; it is not a <cryptographic salt> or a secret key.
For a computed example, the three ASCII bytes `61 62 63` give
`53048e2681941ef99b2e29b76b4c7dabe4c2d0c634fc6d46e0e2f13107e7af23`.
Ordinary <SHA-512> of those bytes begins `ddaf35a193617aba`, while <SHA-256> begins `ba7816bf8f01cfea`. Neither output implements SHA-512/256. In particular, the slash and output width do not mean “hash with ordinary SHA-512 and keep 256 bits”.
The padding also follows the SHA-512 family: a 128-bit length field and 1024-bit blocks. An input of 56 bytes therefore fits into one padded block here, while <SHA-256> needs two of its smaller blocks. The identical 32-byte digest sizes say nothing about those different computations.
Back to article page
