A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?

I guess certain naive MAC implementations might have issues. Are there also some situations where length-extensions cause problems for unkeyed hashes?


The archetypal situation where the length-extension property becomes problematic is when ones builds a Message Authentication Code from a hash function as $$\textrm{BadMAC}(K,M)=\textrm{Hash}(K||M)$$ where $K||M$ is the concatenation of the Key and the Message.

The length extension property then translates directly into the capability to forge a different message, starting as the original, for which computing the $\textrm{BadMAC}$ is trivial.

In practice, that could allow adding an appendix to a text protected by $\textrm{BadMAC}$ (after a short rash of garbage in most cases, but often it could be invisible when printed). Also, that could allow extending the size of a short signed message so that it creates a buffer overflow after its integrity is checked using $\textrm{BadMAC}$.

HMAC is secure against that; and then more.

Another (artificial) example could be when it is asked the hash of increasingly long messages (with precisely the wrong content) as a Proof-Of-Work: one user knowing the hash constituting the POW of a user could abuse that into another POW indicative of slightly more work.

  • 2
    $\begingroup$ Similar multi collision attacks apply to all narrow pipe hashes, since for them, finding a state collision isn't harder than finding an output collision. $\endgroup$ – CodesInChaos Jun 19 '15 at 6:53
  • $\begingroup$ Length-Extension can also be exploited to make for more impressive demonstrations of collision attacks as Thomas explained here. $\endgroup$ – SEJPM Mar 9 '17 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.