Right. The relationship between SHA1 outputs and the IV seemed important to the concept of this being a building block for multicollisions.<p>Also: I think it&#x27;s pretty surprising to generalists (it certainly was to me!) that the SHA1 hash is literally the transformation of the IV, and that you can pick up the results of a SHA1 hash and keep hashing with it. If you grok this, length extension attacks are obvious, as is the benefit of the truncated SHA-2 variants.