diff --git a/common/sha2.c b/common/sha2.c
index a6eb7226..12ba35be 100644
--- a/common/sha2.c
+++ b/common/sha2.c
@@ -460,11 +460,18 @@ static size_t crypto_hashblocks_sha512(uint8_t *statebytes,
     return inlen;
 }
 
+static const uint8_t iv_224[32] = {
+    0xc1, 0x05, 0x9e, 0xd8, 0x36, 0x7c, 0xd5, 0x07,
+    0x30, 0x70, 0xdd, 0x17, 0xf7, 0x0e, 0x59, 0x39,
+    0xff, 0xc0, 0x0b, 0x31, 0x68, 0x58, 0x15, 0x11,
+    0x64, 0xf9, 0x8f, 0xa7, 0xbe, 0xfa, 0x4f, 0xa4
+};
+
 static const uint8_t iv_256[32] = {
     0x6a, 0x09, 0xe6, 0x67, 0xbb, 0x67, 0xae, 0x85,
     0x3c, 0x6e, 0xf3, 0x72, 0xa5, 0x4f, 0xf5, 0x3a,
     0x51, 0x0e, 0x52, 0x7f, 0x9b, 0x05, 0x68, 0x8c,
-    0x1f, 0x83, 0xd9, 0xab, 0x5b, 0xe0, 0xcd, 0x19,
+    0x1f, 0x83, 0xd9, 0xab, 0x5b, 0xe0, 0xcd, 0x19
 };
 
 static const uint8_t iv_384[64] = {
@@ -485,6 +492,15 @@ static const uint8_t iv_512[64] = {
     0x6b, 0x5b, 0xe0, 0xcd, 0x19, 0x13, 0x7e, 0x21, 0x79
 };
 
+void sha224_inc_init(uint8_t *state) {
+    for (size_t i = 0; i < 32; ++i) {
+        state[i] = iv_224[i];
+    }
+    for (size_t i = 32; i < 40; ++i) {
+        state[i] = 0;
+    }
+}
+
 void sha256_inc_init(uint8_t *state) {
     for (size_t i = 0; i < 32; ++i) {
         state[i] = iv_256[i];
@@ -521,6 +537,10 @@ void sha256_inc_blocks(uint8_t *state, const uint8_t *in, size_t inblocks) {
     store_bigendian_64(state + 32, bytes);
 }
 
+void sha224_inc_blocks(uint8_t *state, const uint8_t *in, size_t inblocks) {
+    sha256_inc_blocks(state, in, inblocks);
+}
+
 void sha512_inc_blocks(uint8_t *state, const uint8_t *in, size_t inblocks) {
     uint64_t bytes = load_bigendian_64(state + 64);
 
@@ -581,6 +601,14 @@ void sha256_inc_finalize(uint8_t *out, uint8_t *state, const uint8_t *in, size_t
     }
 }
 
+void sha224_inc_finalize(uint8_t *out, uint8_t *state, const uint8_t *in, size_t inlen) {
+    sha256_inc_finalize(state, state, in, inlen);
+
+    for (size_t i = 0; i < 28; ++i) {
+        out[i] = state[i];
+    }
+}
+
 void sha512_inc_finalize(uint8_t *out, uint8_t *state, const uint8_t *in, size_t inlen) {
     uint8_t padded[256];
     uint64_t bytes = load_bigendian_64(state + 64) + inlen;
@@ -638,6 +666,13 @@ void sha384_inc_finalize(uint8_t *out, uint8_t *state, const uint8_t *in, size_t
     }
 }
 
+void sha224(uint8_t *out, const uint8_t *in, size_t inlen) {
+    uint8_t state[40];
+
+    sha224_inc_init(state);
+    sha224_inc_finalize(out, state, in, inlen);
+}
+
 void sha256(uint8_t *out, const uint8_t *in, size_t inlen) {
     uint8_t state[40];
 
diff --git a/common/sha2.h b/common/sha2.h
index f40a1d32..60073956 100644
--- a/common/sha2.h
+++ b/common/sha2.h
@@ -4,6 +4,11 @@
 #include <stddef.h>
 #include <stdint.h>
 
+void sha224_inc_init(uint8_t *state);
+void sha224_inc_blocks(uint8_t *state, const uint8_t *in, size_t inblocks);
+void sha224_inc_finalize(uint8_t *out, uint8_t *state, const uint8_t *in, size_t inlen);
+void sha224(uint8_t *out, const uint8_t *in, size_t inlen);
+
 void sha256_inc_init(uint8_t *state);
 void sha256_inc_blocks(uint8_t *state, const uint8_t *in, size_t inblocks);
 void sha256_inc_finalize(uint8_t *out, uint8_t *state, const uint8_t *in, size_t inlen);
diff --git a/test/common/sha2.c b/test/common/sha2.c
index aba24ac2..f08eb06b 100644
--- a/test/common/sha2.c
+++ b/test/common/sha2.c
@@ -7,6 +7,12 @@
 
 const unsigned char plaintext[113] = "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu";
 
+const unsigned char expected_224[28] = {
+    0xc9, 0x7c, 0xa9, 0xa5, 0x59, 0x85, 0x0c, 0xe9, 0x7a, 0x04, 0xa9, 0x6d,
+    0xef, 0x6d, 0x99, 0xa9, 0xe0, 0xe0, 0xe2, 0xab, 0x14, 0xe6, 0xb8, 0xdf,
+    0x26, 0x5f, 0xc0, 0xb3
+};
+
 const unsigned char expected_256[32] = {
     0xcf, 0x5b, 0x16, 0xa7, 0x78, 0xaf, 0x83, 0x80, 0x03, 0x6c, 0xe5, 0x9e,
     0x7b, 0x04, 0x92, 0x37, 0x0b, 0x24, 0x9b, 0x11, 0xe8, 0xf0, 0x7a, 0x51,
@@ -56,6 +62,30 @@ static int test_sha256_incremental(void) {
     return 0;
 }
 
+static int test_sha224(void) {
+    unsigned char output[28];
+    int i = 0;
+
+    sha224(output, plaintext, 112);
+
+    if (memcmp(expected_224, output, 28)) {
+        printf("ERROR sha224 output did not match test vector.\n");
+        printf("Expected: ");
+        for (i = 0; i < 28; i++) {
+            printf("%02X", expected_224[i]);
+        }
+        printf("\n");
+        printf("Received: ");
+        for (i = 0; i < 28; i++) {
+            printf("%02X", output[i]);
+        }
+        printf("\n");
+        return 1;
+    }
+
+    return 0;
+}
+
 static int test_sha256(void) {
     unsigned char output[32];
     int i = 0;
@@ -130,6 +160,7 @@ static int test_sha512(void) {
 
 int main(void) {
     int result = 0;
+    result += test_sha224();
     result += test_sha256();
     result += test_sha256_incremental();
     result += test_sha384();