# Hash length extension attack - SHA256 to 512 - impossible, correct?

Just want to be sure about something before I sign off on a method we're about to put into place.

We have a secret, to which a user-defined key is appended. The user can see the SHA256 hash of the secret.

The secret and the user-key is then hashed with SHA512 to obtain results.

Given the ending hash is SHA512, and the user only knows the SHA256, a hash length extension attack would be impossible, correct? As there is no way to convert a 256 to 512, or to backtrack the 256?

From every angle I can see it, it shouldn't be possible. But want to confirm with those more well versed than I. Thanks.

• Of course, it would probably be better is the user can see a commitment to the secret instead of the SHA256 hash of the secret, and if the user-key is then HMACed with the secret instead of them being hashed with SHA512. $\;$
– user991
May 22, 2015 at 5:34
• Guys, maybe something for meta, but I see very few people upvoting questions. Now I can understand not upvoting questions if they are too specific but there seems to be a growing gap between the amount of upvotes for answers and questions. May 22, 2015 at 13:27
• Even if there's no known way I would recommend creating a canonical representation of messages, e.g. by prefixing the length for the user-key. Somebody may look at your code and decide that using a single hash function would be more efficient. At the very minimum create a design document and comment your code. May 22, 2015 at 13:31