Does length-prepending stop length-extension attacks on Merkle-Damgård hash functions, assuming that the length is checked?


1 Answer 1


Yes, if the length is formatted in a constant-size value (e.g. 64-bit field) or in an otherwise uniquely decodable manner.

With such a length field, no hash input can be the the prefix of another valid input. Thus there is no length-extension attack.

(Assumptions include that you reveal no intermediate values, of course.)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.