What are the consequences, in terms of security, of using a padding rule at the beginning of the message? Instead of the end?

For instance, in most hash functions, we are using the following padding rule: appending of a bit 1, followed by a number of 0 such that the total length is a multiple of the block length.

What happens if we change this rule in: prepend a bit 1. Then, prepend a number of 0 such that the total length is a multiple of the block length.

I would like to know if the various security properties that can have a hash function are preserved.

Thank you.

• In order to prove security of a hash function with padding at the beginning, we are going to need an hypothesis stronger than security of the hash function with padding at the end. Proof: consider a hash function as SHA-256, but restricted to input multiple of 512 bits, without padding, and such that its output is all-zero when the last 512-bit block is all-zero. Adding usual padding to this, it becomes SHA-256. With inverted padding, it becomes a function for which it is trivial to create collisions. On the other hand, if we assume security of the function without padding.. – fgrieu Oct 3 '16 at 6:42
• @fgrieu Thanks for your comment. I don't understand why you say "and such that its output is all-zero when the last 512-bit block is all-zero. Adding usual padding to this, it becomes SHA-256." Since it's SHA-256 without padding, why the output is 0 when the last block is 0? Thanks again. – Spock54 Oct 3 '16 at 15:07
• Consider the function F that 1) is restricted to input multiple of 512 bits; 2) processes this input without padding, using the same IV and round function as SHA-256; 3) except for a special case: if the last input block is 512 bits of zero, the output is replaced by 256 bits of zero. Now, if we apply the normal SHA-256 padding to a message (making it multiple of 512 bits), then apply this function F, we have precisely SHA-256 (notice that the special case never triggers). However if we reverse the padding, we have a weak hash function (because the special case can trigger). – fgrieu Oct 3 '16 at 15:57