# Questions about hash functions

Let $H$ be a secure hash function (e.g. SHA256), is it possibile to find $H(M1)$ given $H(M1||M2)$ if the length of $M1$ and/or $M2$ is exact the block size of the hash (that is, 64 bytes for SHA family hashes)?

-
Even with Merkle-Damgard hashes like SHA-256 (which are vulnerable to length extensions attacks) are not vulnerable to length reduction attacks. – CodesInChaos Mar 22 '14 at 15:39
It looks like this would contradict the meaning of "secure hash", but I'm not sure how to formally prove it from the usual hash properties (collision/preimage/second preimage resistance) – Paŭlo Ebermann Mar 23 '14 at 22:27
@PaŭloEbermann I don't think that this directly contradicts the basic security definitions. Indirectly it might do so, since it enables a MitM attack so you probably can only achieve $2^{n/2}$ pre-image resistance. – CodesInChaos Mar 26 '14 at 14:12

## 1 Answer

I think this is formalized as non mallability of hash functions. However, you do not find it as a requirement e.g. in the SHA-3 competition and I think that practical hash functions are not analyzed in this direction. For non-mallability you might want to take a look at http://eprint.iacr.org/2009/065

-