Does length-prepending stop length-extension attacks on Merkle-Damgård hash functions, assuming that the length is checked?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Yes, if the length is formatted in a constant-size value (e.g. 64-bit field) or in an otherwise uniquely decodable manner.
With such a length field, no hash input can be the the prefix of another valid input. Thus there is no length-extension attack.
(Assumptions include that you reveal no intermediate values, of course.)
