The Merkle–Damgård construction — used in the design of many popular hash algorithms such as MD5, SHA1 and SHA2 — is a method of building collision-resistant cryptographic hash functions from collision-resistant one-way compression functions. The Merkle–Damgård construction is also referred to as ...

learn more… | top users | synonyms (1)

1
vote
1answer
42 views

Is this a secure keyed hashing construction?

I need a PRF for use with PBKDF2, however, the only thing I have is the AES block cipher primitive. I'm attempting to derive a keyed hash function from the block cipher. The design is based on the ...
3
votes
0answers
23 views

Why do we need Merkle–Damgård strengthening [duplicate]

Reading through some manuals, wikis and other documentation I'm learning about Merkle–Damgård construction. I understand why padding beginning with '1', followed by '0's is needed, but I can't ...
2
votes
1answer
94 views

Why the $IV$ used in Merkle-Damgard has to be fixed to a specific value?

I just can't figure out why on earth the $IV$ in Merkle-Damgard has to be fixed (that's what the Katz-Lindell book says)? Because even if you choose it randomly from say $\{{0,1}\}^n$ then the ...
0
votes
0answers
67 views

For each of the following modifications to the Merkle-Damgard transform, determine whether the result is collision resistant or not

$(a)$ Modify the construction so that the input length is not included at all (i.e., output $z_B$ and not $z_{B+1}=h^s(z_B||L)$). $(b)$ Modify the construction so that instead of outputting ...
1
vote
1answer
141 views

SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)

The hashing scheme SHA-256 (for instance) is based on Merkle-Damgard construction with the underlying compression function based on the block cipher SHACAL-2 configured in Davies Meyer mode. SHACAL-2 ...
4
votes
1answer
198 views

What is the “compression function” in Merkle-Damgård?

Is the "compression function" in Merkle-Damgård just a collision-resistant, one-way hash function but one that operates only on fixed size inputs? If so, is MD just a way to extend it to work on ...
7
votes
1answer
438 views

Why is EdDSA collision-resilient with SHA-512?

In the Bernstein et al. paper about EdDSA, the authors claim EdDSA is resilient against collisions (i.e. it can still be secure even if the hash function used isn't collision-resistant), drawing on a ...
1
vote
1answer
72 views

MD-compliant hashes don't really accept arbitary length input, do they?

When people talk about hash functions, they usually say that they accept arbitrary-length input, but if you actually look at the padding (eg MD-strengthening padding), you see it's like ...
3
votes
2answers
317 views

Collision in Merkle–Damgård without a collision in compression function

Is it possible to find a collision in Merkle–Damgård just by omitting the extra one bit that is appended to each input without having a collision in compression function?
1
vote
1answer
335 views

What is the exact purpose of length padding in Merkle–Damgård hash functions? [duplicate]

Is a length padding technique in a hash function used to avoid length extension attacks ?
2
votes
1answer
168 views

One Way function and Merkle Damgård

Is it possible keep the "one wayness property" of certain one way function in Merkle-Damgård construction? I'm asking this question because according to Collision-Resistant hashing: Towards making ...
1
vote
2answers
349 views

Different padding rules for Merkle–Damgård and Keccak/sponge function

We learned that length padding was used in Merkle–Damgård where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
1
vote
1answer
275 views

Generalize the Merkle–Damgård construction for any compression function

I am trying to figure out this question: Generalize the Merkle–Damgård construction for any compression func­tion that compresses by at least one bit . You should refer to a general input ...
1
vote
1answer
285 views

Why is an IV used in Merkle–Damgård transform?

In Merkle–Damgård transform, a fixed vector IV is chosen at the beginning, and it is hashed together with the first block x1. I wonder why we don't use x1 straightforward, i.e. hash x1 and the next ...
1
vote
0answers
85 views

Why is Merkle-Damgård construction insecure? [duplicate]

I've been reading about SHA-1. I read that SHA-1 is insecure as it uses the Merkle-Damgård construction and the Merkle-Damgård construction is — according to Wikipedia — susceptible to a variety of ...
4
votes
1answer
709 views

Why is H(message||secret_key) not vulnerable to length-extension attack?

Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$. Why can't he perform the same ...
2
votes
1answer
335 views

Finding a collision for a hash function

I'm trying to find a collision for the following (modified) Merkle–Damgård hash function. Suppose we already have a hash function $h : \mathbb{Z}_2^{2·n} \to \mathbb{Z}_2^n$ for fixed length bit ...
9
votes
1answer
2k views

Is a second preimage attack on MD5 feasible?

What's the practical status of MD5 w.r.t. second-preimage? Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
13
votes
2answers
950 views

Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?

Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
14
votes
3answers
2k views

Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?

I understand the need for padding in MD5. But why do we append the message length to the padding? I heard it strengthens the hash but how? Please provide an example if possible and how it applies to ...