A 224-bit One-way Hash Function: SHA-224
RFC 3874

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 01

Network Working Group                                         R. Housley
Request for Comments: 3874                                Vigil Security
Category: Informational                                   September 2004

                A 224-bit One-way Hash Function: SHA-224

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2004).

Abstract

   This document specifies a 224-bit one-way hash function, called
   SHA-224.  SHA-224 is based on SHA-256, but it uses a different
   initial value and the result is truncated to 224 bits.

1.  Introduction

   This document specifies a 224-bit one-way hash function, called
   SHA-224.  The National Institute of Standards and Technology (NIST)
   announced the FIPS 180-2 Change Notice on February 28, 2004 which
   specifies the SHA-224 one-way hash function.  One-way hash functions
   are also known as message digests.  SHA-224 is based on SHA-256, the
   256-bit one-way hash function already specified by NIST [SHA2].
   Computation of a SHA-224 hash value is two steps.  First, the SHA-256
   hash value is computed, except that a different initial value is
   used.  Second, the resulting 256-bit hash value is truncated to 224
   bits.

   NIST is developing guidance on cryptographic key management, and NIST
   recently published a draft for comment [NISTGUIDE].  Five security
   levels are discussed in the guidance: 80, 112, 128, 192, and 256 bits
   of security.  One-way hash functions are available for all of these
   levels except one.  SHA-224 fills this void.  SHA-224 is a one-way
   hash function that provides 112 bits of security, which is the
   generally accepted strength of Triple-DES [3DES].

   This document makes the SHA-224 one-way hash function specification
   available to the Internet community, and it publishes the object
   identifiers for use in ASN.1-based protocols.

Housley                      Informational                      [Page 1]
RFC 3874        A 224-bit One-way Hash Function: SHA-224  September 2004

1.1.  Usage Considerations

   Since SHA-224 is based on SHA-256, roughly the same amount of effort
   is consumed to compute a SHA-224 or a SHA-256 digest message digest
   value.  Even though SHA-224 and SHA-256 have roughly equivalent
   computational complexity, SHA-224 is an appropriate choice for a
   one-way hash function that provides 112 bits of security.  The use of
   a different initial value ensures that a truncated SHA-256 message
   digest value cannot be mistaken for a SHA-224 message digest value
   computed on the same data.

   Some usage environments are sensitive to every octet that is
   transmitted.  In these cases, the smaller (by 4 octets) message
   digest value provided by SHA-224 is important.

   These observations lead to the following guidance:

   *  When selecting a suite of cryptographic algorithms that all offer
      112 bits of security strength, SHA-224 is an appropriate choice
      for one-way hash function.

   *  When terseness is not a selection criteria, the use of SHA-256 is
      a preferred alternative to SHA-224.

1.2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [STDWORDS].

2.  SHA-224 Description

   SHA-224 may be used to compute a one-way hash value on a message
   whose length less than 2^64 bits.

   SHA-224 makes use of SHA-256 [SHA2].  To compute a one-way hash
   value, SHA-256 uses a message schedule of sixty-four 32-bit words,
   eight 32-bit working variables, and produces a hash value of eight
   32-bit words.

   The function is defined in the exact same manner as SHA-256, with the
   following two exceptions:

      First, for SHA-224, the initial hash value of the eight 32-bit
      working variables, collectively called H, shall consist of the
      following eight 32-bit words (in hex):

Housley                      Informational                      [Page 2]
RFC 3874        A 224-bit One-way Hash Function: SHA-224  September 2004

         H_0 = c1059ed8               H_4 = ffc00b31
         H_1 = 367cd507               H_5 = 68581511
         H_2 = 3070dd17               H_6 = 64f98fa7
         H_3 = f70e5939               H_7 = befa4fa4

      Second, SHA-224 simply makes use of the first seven 32-bit words
      in the SHA-256 result, discarding the remaining 32-bit words in
      the SHA-256 result.  That is, the final value of H is used as
      follows, where || denotes concatenation:

         H_0 || H_1 || H_2 || H_3 || H_4 || H_5 || H_6

3.  Test Vectors

   This section includes three test vectors.  These test vectors can be
   used to test implementations of SHA-224.

3.1.  Test Vector #1

   Let the message to be hashed be the 24-bit ASCII string "abc", which