Hot answers tagged length-extension
To attack a MAC in general, the attacker needs to find a valid MAC of a message that they do not have the MAC for (or find a message collision that allows a different message to have the same MAC digest). In this case, the attacker would be appending data to the original message, not the MAC itself, and trying to obtain a valid MAC for the new message. In ...
No, scrypt in not vulnerable to password extension attacks. Internally, scrypt passes the password to PBKDF2, which uses it as a key for the HMAC function -- hence they've effectively already done the workaround you thought of.
It seems that all this discussion about the IV is just to confuse the reader. Ignore IV. You just have to do a simple length-extension attack on the CBC-MAC. Yes, one message is enough.
Only top voted, non community-wiki answers of a minimum length are eligible