Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let $H$ be a secure hash function (e.g. SHA256), is it possibile to find $H(M1)$ given $H(M1||M2)$ if the length of $M1$ and/or $M2$ is exact the block size of the hash (that is, 64 bytes for SHA family hashes)?

share|improve this question
Even with Merkle-Damgard hashes like SHA-256 (which are vulnerable to length extensions attacks) are not vulnerable to length reduction attacks. – CodesInChaos Mar 22 '14 at 15:39
It looks like this would contradict the meaning of "secure hash", but I'm not sure how to formally prove it from the usual hash properties (collision/preimage/second preimage resistance) – Paŭlo Ebermann Mar 23 '14 at 22:27
@PaŭloEbermann I don't think that this directly contradicts the basic security definitions. Indirectly it might do so, since it enables a MitM attack so you probably can only achieve $2^{n/2}$ pre-image resistance. – CodesInChaos Mar 26 '14 at 14:12

I think this is formalized as non mallability of hash functions. However, you do not find it as a requirement e.g. in the SHA-3 competition and I think that practical hash functions are not analyzed in this direction. For non-mallability you might want to take a look at

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.