<ol>
<li>This We called Domain Separation, when we use same algorithm for different output size.</li>
<li>Separation is necessary because if i found two messages which have hash value (SH256), differs only in last octet and then i can publish the hash value as first 7 octet showing i used SHA224. since i already have two messages colliding on SHA224 which i can use later for forgery attack.
Using domain separation we can avoid such situation</li>
</ol>

CC BY-SA 3.0
2015-02-03T06:42:06.390Z
2015-02-03T06:42:06.390Z
Tarun
<p><a href="http://en.wikipedia.org/wiki/SHA-2">Wikipedia - SHA-2</a> says</p>

<blockquote>
  <p>SHA-224 is identical to SHA-256, except that:</p>
  
  <ul>
  <li>the initial variable values h0 through h7 are different, and</li>
  <li>the output is constructed by omitting h7.</li>
  </ul>
</blockquote>

<p><a href="http://tools.ietf.org/rfc/rfc3874.txt">RFC3874 - A 224-bit One-way Hash Function: SHA-224</a> says</p>

<blockquote>
  <p>The use of a different initial value ensures that a truncated SHA-256
  message digest value cannot be mistaken for a SHA-224 message
  digest value computed on the same data.</p>
</blockquote>

<p>My questions:</p>

<ol>
<li><p>Is the above quoted reason the only reason why SHA-224 and SHA-256 use different initial values?</p></li>
<li><p>Why is it important to make sure that a SHA-256 message digest value cannot be mistaken for a SHA-224 message digest value?</p></li>
<li><p>If we use the same initial values for both hash functions, will the security of either hash function worsen? If yes, how?</p></li>
</ol>

CC BY-SA 3.0
2011-10-02T13:14:45.653Z
This is almost certainly a better fit on [crypto.SE](http://crypto.stackexchange.com/).
Peter Taylor
CC BY-SA 3.0
2011-10-02T17:21:17.237Z
At least question 2 seems to be off-topic here. After all, it is related to how people use computers and what is convenient for them; not really a TCS question.
Jukka Suomela
CC BY-SA 3.0
2013-05-14T16:42:27.600Z
Related question on Crypto.SE: http://crypto.stackexchange.com/questions/3946/using-sha-256-with-different-initial-hash-value
mikeazo
<cr.crypto-security><hash-function>
Why SHA-224 and SHA-256 use different initial values?
netvope
# Why SHA-224 and SHA-256 use different initial values?

(Asked by: username_0 on 2011-10-02)

[Wikipedia - SHA-2](http://en.wikipedia.org/wiki/SHA-2) says

> SHA-224 is identical to SHA-256, except that:
>
> * the initial variable values h0 through h7 are different, and
> * the output is constructed by omitting h7.

[RFC3874 - A 224-bit One-way Hash Function: SHA-224](http://tools.ietf.org/rfc/rfc3874.txt) says

> The use of a different initial value ensures that a truncated SHA-256
> message digest value cannot be mistaken for a SHA-224 message
> digest value computed on the same data.

My questions:

1. Is the above quoted reason the only reason why SHA-224 and SHA-256 use different initial values?
2. Why is it important to make sure that a SHA-256 message digest value cannot be mistaken for a SHA-224 message digest value?
3. If we use the same initial values for both hash functions, will the security of either hash function worsen? If yes, how?

**Tags:** cr.crypto-security, hash-function

> **Comments:**
> **username_1**: This is almost certainly a better fit on [crypto.SE](http://crypto.stackexchange.com/).  
> **username_2**: At least question 2 seems to be off-topic here. After all, it is related to how people use computers and what is convenient for them; not really a TCS question.  
> **username_3**: Related question on Crypto.SE: http://crypto.stackexchange.com/questions/3946/using-sha-256-with-different-initial-hash-value  

---

## 1 answers

### Answer by username_4 on 2015-02-03. Score: 5

1. This We called Domain Separation, when we use same algorithm for different output size.
2. Separation is necessary because if i found two messages which have hash value (SH256), differs only in last octet and then i can publish the hash value as first 7 octet showing i used SHA224. since i already have two messages colliding on SHA224 which i can use later for forgery attack.
   Using domain separation we can avoid such situation


---

