Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Is it possible to combine SHA1 digest values to get the SHA1 of the concatenated parts ? I know the "S1" SHA1 of "part 1" and the "S2" SHA1 of the "part 2" and I would like to know the SHA1 of the "part 1" concatenated with "part 2" calculated from "S1" and "S2".

Is it possible ?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

No.

Most (all?) cryptographic hashes are designed to prevent that kind of relationship. Additionally, SHA1 uses padding and the file size as part of the hash calculation.

The specific reason it is not possible is because the hash is calculated from an initial hash value. This initial value is the same for both S1 and S2. In order to be able to chain the hash as you described, both S1 and an unpadded hash of the first data set would need to be equal to the initial value of SHA1, AND the first data set would need to be a multiple of 512 bits.

Because of way hash functions work, the chances of S1 being equal to the initial hash value of SHA1 is effectively 0, and the other conditions required are equally infeasible.

share|improve this answer
    
It is possible to do it with MD5. –  Gabor Forgacs Jun 17 at 10:38
2  
@GaborForgacs: how is it possible with MD5? –  poncho Jun 17 at 15:48

No.

Something similar which might be confused:

If $M$ is an unknown message and you know $h = \operatorname{hash}(M)$ and $l = \operatorname{length}(M)$, then for many hash functions it is possible to calculate the hash $h'$ a message $M' = M\ ||\ P\ ||\ X$, with $P$ only depending on $l$ (and the hash function) and $X$ arbitrary chosen by me (or by someone else).

It is still necessary to know $X$ to do the attack, mere knowledge of $\operatorname{hash}(X)$ doesn't help.

This attack (length extension) applies to many older hash functions, including MD5, SHA-1, and all hashes of the SHA-2 family. It doesn't apply to any of the SHA-3 candidates (because resistance against this was a criterion).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.