SHA1 multipart calculation

Is it possible to combine SHA1 digest values to get the SHA1 of the concatenated parts ? I know the "S1" SHA1 of "part 1" and the "S2" SHA1 of the "part 2" and I would like to know the SHA1 of the "part 1" concatenated with "part 2" calculated from "S1" and "S2".

Is it possible ?

No.

Most (all?) cryptographic hashes are designed to prevent that kind of relationship. Additionally, SHA1 uses padding and the file size as part of the hash calculation.

The specific reason it is not possible is because the hash is calculated from an initial hash value. This initial value is the same for both S1 and S2. In order to be able to chain the hash as you described, both S1 and an unpadded hash of the first data set would need to be equal to the initial value of SHA1, AND the first data set would need to be a multiple of 512 bits.

Because of way hash functions work, the chances of S1 being equal to the initial hash value of SHA1 is effectively 0, and the other conditions required are equally infeasible.

• It is possible to do it with MD5. Jun 17 '14 at 10:38
• @GaborForgacs: how is it possible with MD5? Jun 17 '14 at 15:48

No.

Something similar which might be confused:

If $M$ is an unknown message and you know $h = \operatorname{hash}(M)$ and $l = \operatorname{length}(M)$, then for many hash functions it is possible to calculate the hash $h'$ a message $M' = M\ ||\ P\ ||\ X$, with $P$ only depending on $l$ (and the hash function) and $X$ arbitrary chosen by me (or by someone else).

It is still necessary to know $X$ to do the attack, mere knowledge of $\operatorname{hash}(X)$ doesn't help.

This attack (length extension) applies to many older hash functions, including MD5, SHA-1, and all hashes of the SHA-2 family. It doesn't apply to any of the SHA-3 candidates (because resistance against this was a criterion).