Let $H$ be a secure hash function (e.g. SHA256), is it possibile to find $H(M1)$ given $H(M1||M2)$ if the length of $M1$ and/or $M2$ is exact the block size of the hash (that is, 64 bytes for SHA family hashes)?
• @PaŭloEbermann I don't think that this directly contradicts the basic security definitions. Indirectly it might do so, since it enables a MitM attack so you probably can only achieve $2^{n/2}$ pre-image resistance. Mar 26 '14 at 14:12