Hot answers tagged hash
3
How does the length extension attack against $H(k||m)$ work?
For Merkle-Damgård hashes, if you know $H(x)$ but not $x$ you can still choose an $e$ and then compute $H(x||p||e)$. With $x=k||m$ you can compute $H((k||m||p)||e)=H(k||(m||p||e))$ which is a valid authentication tag for $m||p||e$.
Why doesn't it work against $H(m||k)$?
With a length extension ...
1
Your hypothetical hash function would need to have an output length at least equal to the input length to satisfy your conditions, so it wouldn't be a hash function. See the Pigeonhole principle.
Remember an n-bit hash function is a function from $\{0,1\}^∗$ to $\{0,1\}^n$, no such function can meet both of your conditions. Essentially, if it has length $n$ ...
1
I'm having a hard time parsing your question.
If C can compute pre-images on $H$, then he can forge digital signatures from Bob. All C needs is one signature from Bob.
Bob signs message $m$, the signature is $S={H(m)}^d\bmod n$. All C needs to do is find an $m'$ where $H(m)=H(m')$. The forged message and signature will be $m'$ and the original $S$.
Only top voted, non community-wiki answers of a minimum length are eligible
