Is a length padding technique in a hash function used to avoid length extension attacks ?

  • $\begingroup$ Clearly including the length of the message in the padding in Merkle-Damgaard hashes does not prevent length extension attacks since they are vulnerable to this attack. $\endgroup$ Sep 3, 2014 at 11:07

1 Answer 1


Hash functions are defined to work on an arbitrary integer number of blocks. The minimal quantity of data that can be processed by an hash function is a single block.

So, if the message size is not an integer multiple of the block size one has to pad it to the right size.

One needs also to make the message + padding have one and one only interpretation, otherwise it would be simple to create collisions. Therefore adding the padding lenght gives an unique way to interprete the message+padding couple.

As example: let's imagine that one pads addings just zeros to achieve the right lenght. Therefore message $m$ and message $m||0$ have the same hash image.

  • $\begingroup$ But that doesn't explain why the padding contains the length of the message. At least that's how I understand the question, but it's so vague that your interpretation of "why is padding used" might also be what the OP wants. $\endgroup$ Sep 3, 2014 at 11:08
  • $\begingroup$ you don't need to put the padding lenght in the padding, you could add $10\dots 0$ to achieve the right size, with the rule that if the message size is a integer multiple of the block size you'll add an entire block as padding. $\endgroup$
    – ddddavidee
    Sep 3, 2014 at 11:14
  • $\begingroup$ MD hashes do put the length into the padding. I interpret the question as asking why they use the length in the padding instead of a simpler padding, like the one you suggest. My favourite hashes (Skein and Blake2) use even simpler padding (just zeros) and use a different mechanism of signaling the end of the message. $\endgroup$ Sep 3, 2014 at 11:22
  • $\begingroup$ Ok, I've probably misunderstood the question. (Now I'm intrigued about Skein and Blake techniques... have you a good pointer?) $\endgroup$
    – ddddavidee
    Sep 3, 2014 at 11:24
  • 1
    $\begingroup$ Normal compression functions have two inputs, the chaining value and the message block. Skein uses a tweakable compression function which has a third input. It uses this input to signal the end of the message end of the message, preventing length extension attacks. It also uses it to pass a kind of block counter to each compression, so a unique compression function is used for each position in the hash, which improves second pre-image resistance compared to MD hashes. Take a look at the Skein paper, it's pretty readable. $\endgroup$ Sep 3, 2014 at 11:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.