SHA-224 Differences

SHA-224 is SHA-256 with two changes. Everything else — K constants, message schedule, compression rounds, padding, byte order — is identical. That's why a single 50-line library can compute both.

Difference 1: Initial hash values

SHA-256 uses square roots of primes 2..19. SHA-224 uses fractional bits of the square roots of primes 23..53:

H[0] = 0xc1059ed8    (sqrt of 23)
H[1] = 0x367cd507    (sqrt of 29)
H[2] = 0x3070dd17    (sqrt of 31)
H[3] = 0xf70e5939    (sqrt of 37)
H[4] = 0xffc00b31    (sqrt of 41)
H[5] = 0x68581511    (sqrt of 43)
H[6] = 0x64f98fa7    (sqrt of 47)
H[7] = 0xbefa4fa4    (sqrt of 53)

Why different IVs? Domain separation. If SHA-224 used the same IVs as SHA-256, then SHA-224(M) would just be the leading 224 bits of SHA-256(M) — which would mean you could attack the longer hash by attacking the shorter one and vice versa.

Difference 2: Output truncation

After the final compression, SHA-256 emits 8 words (256 bits). SHA-224 emits the first 7 words (224 bits = 28 bytes):

Test vectors (FIPS 180-4 Appendix B)

"":     d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f
"abc":  23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7

Why does SHA-224 exist?

Two reasons:

1. Output size matches 3DES key size. Some 1990s protocols took 224-bit keys; SHA-224 lets you derive them without wasting bits.
2. Birthday-collision parity with 112-bit security. 224/2 = 112 bits of collision resistance, matching some legacy systems.

In practice SHA-224 is rarely used — most modern code uses SHA-256, SHA-384, or SHA-512. But knowing how trivially it's derived from SHA-256 cements the underlying design.

Family overview

SHA-384/512 use 64-bit arithmetic, 80 rounds, different constants — but the same Merkle-Damgård + Davies-Meyer-ish skeleton.