Let $H$ be a secure hash function (e.g. SHA256), is it possibile to find $H(M1)$ given $H(M1||M2)$ if the length of $M1$ and/or $M2$ is exact the block size of the hash (that is, 64 bytes for SHA family hashes)?

  • $\begingroup$ Even with Merkle-Damgard hashes like SHA-256 (which are vulnerable to length extensions attacks) are not vulnerable to length reduction attacks. $\endgroup$ Mar 22 '14 at 15:39
  • $\begingroup$ It looks like this would contradict the meaning of "secure hash", but I'm not sure how to formally prove it from the usual hash properties (collision/preimage/second preimage resistance) $\endgroup$ Mar 23 '14 at 22:27
  • 2
    $\begingroup$ @PaŭloEbermann I don't think that this directly contradicts the basic security definitions. Indirectly it might do so, since it enables a MitM attack so you probably can only achieve $2^{n/2}$ pre-image resistance. $\endgroup$ Mar 26 '14 at 14:12

I think this is formalized as non mallability of hash functions. However, you do not find it as a requirement e.g. in the SHA-3 competition and I think that practical hash functions are not analyzed in this direction. For non-mallability you might want to take a look at http://eprint.iacr.org/2009/065


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.