0
$\begingroup$

Assume that we have (know):

  1. Hash(A)
  2. Length of A
  3. A's character type ([0->9],[a->z])
  4. A is a string
  5. Everything about B (original string, Length, etc.)
  6. HashMethod SHA256
  7. Note: A's original value is unknown

Is there a way to use that information to create Hash(A||B) [|| is concatenate {"a" || "b" -> "ab" for example}]

$\endgroup$
1

2 Answers 2

4
$\begingroup$

Is there a way to use that information to create Hash(A||B)

No, it is not. However, we can come close: we can compute Hash(A||PadA||B), where PadA is a string that depends on the length of A (but not on its contents). This is known as the 'length extension attack' on SHA256.

$\endgroup$
4
  • $\begingroup$ Thanks for your reply, I have a further question: What you do mean by "come close", I thought it is "Right or Wrong" matter $\endgroup$ Commented Jun 30, 2022 at 14:12
  • $\begingroup$ @HoiNhonNguyen: "come close" means "you can't do exactly what you ask, however by tweaking the problem a little, you can solve the tweaked problem" $\endgroup$
    – poncho
    Commented Jun 30, 2022 at 14:53
  • $\begingroup$ Apart from "Length extension attack" is there any other method to be considered? $\endgroup$ Commented Jun 30, 2022 at 16:01
  • $\begingroup$ @HoiNhonNguyen: well, if the length of A is not too large, you could use a brute force (or rainbow table) to recover it; once you know A, computing Hash(A||B) is easy... $\endgroup$
    – poncho
    Commented Jun 30, 2022 at 17:30
0
$\begingroup$

If the output needs to be a SHA256 digest then there's not much you can do except what is mentioned by @poncho. But if you want to use SHA256 in a Merkle tree then you can chunk A up into small pieces and make a Merkle root out of it, this is your Hash(A). When B is available you do the same. Finally, you hash those two Merkle roots together to create Hash(A||B). Of course, the length of A and B should be the same ideally.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.