Let $H$ be a secure hash function (e.g. SHA256), is it possibile to find $H(M1)$ given $H(M1||M2)$ if the length of $M1$ and/or $M2$ is exact the block size of the hash (that is, 64 bytes for SHA family hashes)?
$\begingroup$
$\endgroup$
3
-
$\begingroup$ Even with Merkle-Damgard hashes like SHA-256 (which are vulnerable to length extensions attacks) are not vulnerable to length reduction attacks. $\endgroup$– CodesInChaosMar 22, 2014 at 15:39
-
$\begingroup$ It looks like this would contradict the meaning of "secure hash", but I'm not sure how to formally prove it from the usual hash properties (collision/preimage/second preimage resistance) $\endgroup$– Paŭlo EbermannMar 23, 2014 at 22:27
-
2$\begingroup$ @PaŭloEbermann I don't think that this directly contradicts the basic security definitions. Indirectly it might do so, since it enables a MitM attack so you probably can only achieve $2^{n/2}$ pre-image resistance. $\endgroup$– CodesInChaosMar 26, 2014 at 14:12
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
I think this is formalized as non mallability of hash functions. However, you do not find it as a requirement e.g. in the SHA-3 competition and I think that practical hash functions are not analyzed in this direction. For non-mallability you might want to take a look at http://eprint.iacr.org/2009/065