FIPS 180-4 defines SHA-512/224 as a 224-bit truncation of a modified version of SHA-512. The
modification consists of replacing the SHA-512 IV with an IV defined by hashing the string
“SHA-512/224”. FIPS 180-4 defines SHA-512/256 similarly.
This document defines SHA-512/832 as a concatenation of two 416-bit truncations of modified
SHA-512 hash outputs, where the first modification uses an IV obtained as in FIPS 180-4 from
the string “SHA-512/832part0/2”, and the first modification uses an IV obtained as in FIPS
180-4 from the string “SHA-512/832part1/2”. This document similarly defines SHA-512/912 as a
concatenation of two 456-bit truncations of modified SHA-512 hash outputs. This document also
defines SHA-512/1056 as a concatenation of four 264-bit truncations of modified SHA-512 hash
outputs, with strings “SHA-512/1056part0/4” etc.
Examples: Ed25519-SHA-512 and SHA-512-Ed25519-SHA-512. Ed25519-SHA-512 is
PureEdDSA with the following parameters: q is the prime 2255 − 19; b = 256; the 255-bit encoding
of F2255 −19 is the usual little-endian encoding of {0, 1, . . . , 2255 − 20}; H is SHA-512; c = 3; n = 254;
a = −1; d = −121665/121666; B is the point (. . . 202, 4/5) ∈ E; and is the prime