SHA-224初始哈希值H(0)的获取方式是什么？基于RFC 6234解析

Great question! You’re correct that RFC 6234 explicitly covers how the initial hash values H(0) are derived for SHA-256, SHA-384, and SHA-512, but it does specify SHA-224’s H(0) in §6.1 (right alongside SHA-256’s initialization details).

SHA-224's Explicit H(0) Values #

SHA-224 uses 8 32-bit words for its initial hash state, defined as these hexadecimal values:

H(0)0 = c1059ed8
H(0)1 = 367cd507
H(0)2 = 3070dd17
H(0)3 = f70e5939
H(0)4 = ffc00b31
H(0)5 = 68581511
H(0)6 = 64f98fa7
H(0)7 = befa4fa4

Context with Other SHA-2 Algorithms #

To tie this to the rest of RFC 6234’s initialization rules:

• SHA-256: Its H(0) comes from the first 32 bits of the fractional parts of the square roots of the first 8 primes.
• SHA-384: Its H(0) uses 64-bit words taken from the first 64 bits of the fractional parts of the square roots of primes 9 through 16. A handy observation: each 32-bit word in SHA-224’s H(0) is exactly the lower 32 bits of the corresponding 64-bit word in SHA-384’s H(0). For example:
  • SHA-384 H(0)0 = cbbb9d5dc1059ed8 → lower 32 bits = c1059ed8 (SHA-224 H(0)0)
  • SHA-384 H(0)1 = 629a292a367cd507 → lower 32 bits = 367cd507 (SHA-224 H(0)1)
• SHA-512: Its H(0) uses 64-bit words from the first 64 bits of the fractional parts of the square roots of the first 8 primes.

内容的提问来源于stack exchange，提问作者Константин Ван