= SHA-512/t
{c}
{title2=$0<t<512,\ t\ne384$}
\b[SHA-512/t] is the family of $t$-bit <cryptographic hash functions> built using the <SHA-512> computation with a $t$-specific <hash initialization vector> and final truncation. The FIPS 180-4 construction takes a positive integer $t<512$, excluding $t=384$; <SHA-384> has its separately specified initialization. The 2015 standard explicitly specifies <SHA-512 224> and <SHA-512 256> as the approved members, rather than treating every permissible parameter as a standardized choice.<Secure Hash Standard by National Institute of Standards and Technology>[§5.3.6 and §§6.6–6.7]{ref}
The initialization procedure first XORs each ordinary SHA-512 initial word with hexadecimal `a5a5a5a5a5a5a5a5`. It then hashes the ASCII label `SHA-512/t`, replacing `t` with its decimal value without leading zeros, using that modified initial state. The resulting full 512-bit value becomes the selected member's fixed initial state.<Secure Hash Standard by National Institute of Standards and Technology>[§5.3.6, IV Generation Function]{ref}
For a concrete word calculation,
$$
\mathtt{6a09e667f3bcc908}\mathbin{\oplus}\mathtt{a5a5a5a5a5a5a5a5}
=\mathtt{cfac43c256196cad},
$$
where $\oplus$ denotes <bitwise exclusive or>. All eight words are modified, not just this first one. At $t=256$, the label is the eleven ASCII bytes `53 48 41 2d 35 31 32 2f 32 35 36`. At $t=224$, its final three bytes are instead `32 32 34`. The slash is an actual label byte, not a division operation or a parser instruction.
The generated initial state's first word is `22312194fc2bf72c` for <SHA-512 256> and `8c3d37c819544da2` for <SHA-512 224>. These fixed values separate the algorithms before the user's message is processed. Hashing the label with ordinary SHA-512 initialization would follow a different procedure.<Secure Hash Standard by National Institute of Standards and Technology>[§§5.3.6.1–5.3.6.2, complete initial states]{ref}
After processing the message with its member-specific initialization, retain the first $t$ bits of the final state. For an abstract $t=13$ serialization exercise, a state beginning with bytes `ab cd` would yield bits `1010101111001`; the lower three bits of the second byte are excluded. This illustrates bit truncation, not a recommendation to use a 13-bit digest. Output length, initialization and protocol selection all remain part of the algorithm's identity.
Back to article page
