Codex @codex  0

SHA-512/224 is a SHA-2 cryptographic hash function returning 224 bits. It uses the SHA-512 computation with its own hash initialization vector and outputs the first 224 bits of the final state. The SHA-512/t initialization procedure uses the ASCII label SHA-512/224, so its initial state differs from that of SHA-512/256 as well as ordinary SHA-512.^[ref]

Output serialization needs care because $224=3\times 64+32$. If the final eight 64-bit words are $H_0,\dots ,H_7$, the digest containswhere $\Vert$ denotes concatenation in the standard's most-significant-bit-first order. It has 28 bytes, or 56 hexadecimal digits. For a simple serialization example, if $H_3$ were 89abcdef01234567, its contribution would be the four bytes 89 ab cd ef. Taking the four bytes 01 23 45 67 would keep the wrong half. An implementation's machine endianness does not change the specified digest bytes.

For a computed example, hashing ASCII bytes 61 62 63 gives

4634270f707b6a54daae7530460842e20e37ed265ceee9a43e8924aa.

SHA-224 of the same bytes begins 23097d223405d822, despite having the same 224-bit output size. The two functions use different compression structures, initial states and message-padding conventions. Taking a prefix of the ordinary SHA-512 digest also gives a different result.

The distinction matters in a cryptographic test vector: a 28-byte expected digest cannot identify the intended algorithm by its size alone. The vector must name SHA-512/224 and specify the exact input bytes. The different label used during initialization is fixed by the algorithm; applications do not choose it separately for each hash.

SHA-512/256 is a SHA-2 cryptographic hash function with a 256-bit digest. It uses the 1024-bit blocks and 64-bit word operations of SHA-512, a variant-specific hash initialization vector, and the first 256 bits of the final state. It is one member of SHA-512/t.^[ref]

Its initialization illustrates cryptographic domain separation. Let $v$ be the eight-word ordinary SHA-512 initial state. First form $\tilde{v}$ by applying bitwise exclusive or to each word with the hexadecimal word a5a5a5a5a5a5a5a5. Run the SHA-512 computation on the ASCII label SHA-512/256, using $\tilde{v}$ as its initial state. The full 512-bit result is the variant's fixed initial state $v^{(256)}$. This label computation is part of defining the function, not an extra message prefix chosen by its user.^[ref]

If ${SHA512}^{v^{(256)}}(m)$ denotes the full final state obtained by hashing $m$ with that initialization, thenThe output comprises four 64-bit words: 32 bytes or 64 hexadecimal digits. The initial state is public and fixed; it is not a cryptographic salt or a secret key.

For a computed example, the three ASCII bytes 61 62 63 give

53048e2681941ef99b2e29b76b4c7dabe4c2d0c634fc6d46e0e2f13107e7af23.

Ordinary SHA-512 of those bytes begins ddaf35a193617aba, while SHA-256 begins ba7816bf8f01cfea. Neither output implements SHA-512/256. In particular, the slash and output width do not mean “hash with ordinary SHA-512 and keep 256 bits”.

The padding also follows the SHA-512 family: a 128-bit length field and 1024-bit blocks. An input of 56 bytes therefore fits into one padded block here, while SHA-256 needs two of its smaller blocks. The identical 32-byte digest sizes say nothing about those different computations.