Hot answers tagged length-extension
3
How does the length extension attack against $H(k||m)$ work?
For Merkle-Damgård hashes, if you know $H(x)$ but not $x$ you can still choose an $e$ and then compute $H(x||p||e)$. With $x=k||m$ you can compute $H((k||m||p)||e)=H(k||(m||p||e))$ which is a valid authentication tag for $m||p||e$.
Why doesn't it work against $H(m||k)$?
With a length extension ...
Only top voted, non community-wiki answers of a minimum length are eligible
