Length extension attacks are attacks on hash and message authentication code (MAC) functions that allow extra information to be added (typically appended) to the input message without invalidating the resulting hash/MAC value.

Hash functions created using an unmodified Merkle–Damgård construction, including MD5, SHA1, SHA256 and SHA512 are vulnerable to length extension, as is CBC-MAC.

Merkle–Damgård based hash functions that truncate the internal state (such as SHA224 and SHA384), the HMAC construction, and newer hash function designs such as SHA-3/Keccak, and the SHA-3 competition finalists Skein and Blake are not vulnerable to length extension.

See the wikipedia page for more information.

history | show excerpt | excerpt history