RFC 3874

A 224-bit One-way Hash Function: SHA-224

📅 published September 2004, from ietf

A 224-bit One-way Hash Function: SHA-224 🎀

okay bestie, this one is RFC 3874 💖 It's an Informational doc (so it's just sharing info, not a standard 💅), written by Russell Housley at Vigil Security, dated September 2004 ✨. The title block has no Obsoletes or Updates line, so it doesn't replace or update any other RFC 🦋

Status of this Memo 🌸

This memo gives info to the Internet community. It doesn't specify an Internet standard of any kind. Distribution is unlimited 💜

Copyright Notice 🫶

Abstract ✨

okay so this doc specifies a 224-bit one-way hash function called SHA-224 🔥 It's based on SHA-256, but it uses a different initial value, and the result gets truncated to 224 bits 🧚

1. Introduction ✨

So this doc specifies that same 224-bit one-way hash function, SHA-224 💅 NIST (the National Institute of Standards and Technology) announced the FIPS 180-2 Change Notice on February 28, 2004, and that notice is what specifies SHA-224 🍓 One-way hash functions are also called message digests. SHA-224 is based on SHA-256, which NIST already specified as a 256-bit one-way hash function [SHA2] 👑

Computing a SHA-224 hash is literally two steps 😭 First, you compute the SHA-256 hash value, except you use a different initial value. Second, you truncate that 256-bit hash value down to 224 bits. Easy, right? 💀

NIST is working on guidance for cryptographic key management, and they recently put out a draft for comment [NISTGUIDE] 🌈 The guidance talks about five security levels: 80, 112, 128, 192, and 256 bits of security. One-way hash functions exist for all of those levels except one, and SHA-224 fills that gap ⭐ SHA-224 gives you 112 bits of security, which is the generally accepted strength of Triple-DES [3DES] 🦋

This doc makes the SHA-224 spec available to the Internet community, and it publishes the object identifiers for use in ASN.1-based protocols 🎀

1.1. Usage Considerations 🍓

SHA-224 is based on SHA-256, so roughly the same amount of effort goes into computing a SHA-224 digest or a SHA-256 digest message digest value. Even though they have roughly equivalent computational complexity, SHA-224 is a good pick for a one-way hash function that gives you 112 bits of security 💅 The different initial value makes sure a truncated SHA-256 message digest value can't be mistaken for a SHA-224 message digest value computed on the same data 🙈

Some usage environments are super sensitive to every octet that gets transmitted. In those cases, the smaller message digest value (smaller by 4 octets) that SHA-224 gives you really matters 🫶

So here's the guidance:

When you're picking a suite of cryptographic algorithms that all offer 112 bits of security strength, SHA-224 is an appropriate choice for a one-way hash function 🔥
When terseness is not a selection criteria, SHA-256 is the preferred alternative to SHA-224 👑

1.2. Terminology 📚

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [STDWORDS] 🧚

2. SHA-224 Description ✨

SHA-224 may be used to compute a one-way hash value on a message whose length is less than 2^64 bits 🌸

SHA-224 makes use of SHA-256 [SHA2]. To compute a one-way hash value, SHA-256 uses a message schedule of sixty-four 32-bit words, eight 32-bit working variables, and produces a hash value of eight 32-bit words 💜

The function is defined in the exact same manner as SHA-256, with these two exceptions 🦋

First, for SHA-224, the initial hash value of the eight 32-bit working variables (collectively called H) shall consist of the following eight 32-bit words, in hex:

H_0 = c1059ed8               H_4 = ffc00b31
H_1 = 367cd507               H_5 = 68581511
H_2 = 3070dd17               H_6 = 64f98fa7
H_3 = f70e5939               H_7 = befa4fa4

Second, SHA-224 just uses the first seven 32-bit words of the SHA-256 result and throws away the remaining 32-bit words 🗑️ So the final value of H gets used like this, where || means concatenation:

H_0 || H_1 || H_2 || H_3 || H_4 || H_5 || H_6

3. Test Vectors 🧪

This section has three test vectors, and you can use them to test your SHA-224 implementation 🎀

3.1. Test Vector #1 🍓

Let the message to be hashed be the 24-bit ASCII string "abc", which is equivalent to this binary string:

01100001 01100010 01100011

The SHA-224 hash value (in hex):

23097d22 3405d822 8642a477 bda255b3 2aadbce4 bda0b3f7 e36c9da7

3.2. Test Vector #2 🌈

Let the message to be hashed be the 448-bit ASCII string "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq".

The SHA-224 hash value is (in hex):

75388b16 512776cc 5dba5da1 fd890150 b0c6455c b4f58b19 52522525

3.3. Test Vector #3 💀

Let the message to be hashed be the binary-coded form of the ASCII string that consists of 1,000,000 repetitions of the character "a".

The SHA-224 hash value is (in hex):

20794655 980c91d8 bbb4c1ea 97618a4b f03f4258 1948b2ee 4ee7ad67

4. Object Identifier 🪪

NIST has assigned an ASN.1 [X.208-88, X.209-88] object identifier for SHA-224. Some protocols use object identifiers to name one-way hash functions, and CMS [CMS] is one example 🧚 So, implementations of such protocols that use SHA-224 MUST use the following object identifier 🔥

id-sha224  OBJECT IDENTIFIER  ::=  { joint-iso-itu-t(2)
                country(16) us(840) organization(1) gov(101)
                csor(3) nistalgorithm(4) hashalgs(2) sha224(4) }

5. Security Considerations 🚨

⚠️ This section is serious business, so read it carefully, bestie 🙏

One-way hash functions are typically used with other cryptographic algorithms, like digital signature algorithms and keyed-hash message authentication codes, or when generating random values 🔐 When a one-way hash function gets used together with another algorithm, there may be requirements specified elsewhere that call for a one-way hash function with a certain number of bits of security. For example, if a message is being signed with a digital signature algorithm that provides 128 bits of security, then that signature algorithm may require a one-way hash algorithm that also provides the same number of bits of security 😱 SHA-224 is intended to provide 112 bits of security, which is the generally accepted strength of Triple-DES [3DES] 💅

This doc is meant to provide the SHA-224 spec to the Internet community. The author doesn't intend any independent assertion of the security of this one-way hash function for any particular use. However, as long as SHA-256 provides the expected security, SHA-224 will also provide its expected level of security 🫶

6. References 📚

6.1. Normative References 💜

[SHA2]      Federal Information Processing Standards Publication
            (FIPS PUB) 180-2, Secure Hash Standard, 1 August 2002.

[STDWORDS]  Bradner, S., "Key words for use in RFCs to Indicate
            Requirement Levels", BCP 14, RFC 2119, March 1997.

6.2. Informative References 🦋

[3DES]      American National Standards Institute.  ANSI X9.52-1998,
            Triple Data Encryption Algorithm Modes of Operation.
            1998.

[CMS]       Housley, R., "Cryptographic Message Syntax (CMS)", RFC
            3852, July 2004.

[NISTGUIDE] National Institute of Standards and Technology.  Second
            Draft: "Key Management Guideline, Part 1:  General
            Guidance."  June 2002.
            [http://csrc.nist.gov/encryption/kms/guideline-1.pdf]

[X.208-88]  CCITT Recommendation X.208: Specification of Abstract
            Syntax Notation One (ASN.1). 1988.

[X.209-88]  CCITT Recommendation X.209: Specification of Basic
            Encoding Rules for Abstract Syntax Notation One (ASN.1).
            1988.

7. Acknowledgments 🫶

Huge thanks to Jim Schaad for generating the test vectors 🧚 A second implementation by Brian Gladman was used to confirm that the test vectors are correct 🙌

8. Author's Address 🏡

Russell Housley
Vigil Security, LLC
918 Spring Knoll Drive
Herndon, VA 20170
USA

EMail: housley@vigilsec.com

9. Full Copyright Statement 💅

This doc is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights 🔐

This document and the information in it are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/S HE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 😭

Intellectual Property 🌸

The IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to apply to the implementation or use of the technology described in this document, or on whether any license under such rights might or might not be available. It also doesn't claim to have made any independent effort to find such rights. Info on the IETF's procedures for rights in IETF Documents can be found in BCP 78 and BCP 79 🧾

Copies of IPR disclosures made to the IETF Secretariat, and any assurances of licenses to be made available, or the result of an attempt to get a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr 🔗

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology required to implement this standard. Please send that info to the IETF at ietf-ipr@ietf.org 💌

Acknowledgement 🌈

Funding for the RFC Editor function is currently provided by the Internet Society 💖

📦 where this page comes from

ietf: rfc3874 2004-09
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms