1
$\begingroup$

What are the consequences, in terms of security, of using a padding rule at the beginning of the message? Instead of the end?

For instance, in most hash functions, we are using the following padding rule: appending of a bit 1, followed by a number of 0 such that the total length is a multiple of the block length.

What happens if we change this rule in: prepend a bit 1. Then, prepend a number of 0 such that the total length is a multiple of the block length.

I would like to know if the various security properties that can have a hash function are preserved.

Thank you.

$\endgroup$
  • $\begingroup$ In order to prove security of a hash function with padding at the beginning, we are going to need an hypothesis stronger than security of the hash function with padding at the end. Proof: consider a hash function as SHA-256, but restricted to input multiple of 512 bits, without padding, and such that its output is all-zero when the last 512-bit block is all-zero. Adding usual padding to this, it becomes SHA-256. With inverted padding, it becomes a function for which it is trivial to create collisions. On the other hand, if we assume security of the function without padding.. $\endgroup$ – fgrieu Oct 3 '16 at 6:42
  • $\begingroup$ @fgrieu Thanks for your comment. I don't understand why you say "and such that its output is all-zero when the last 512-bit block is all-zero. Adding usual padding to this, it becomes SHA-256." Since it's SHA-256 without padding, why the output is 0 when the last block is 0? Thanks again. $\endgroup$ – Spock54 Oct 3 '16 at 15:07
  • $\begingroup$ Consider the function F that 1) is restricted to input multiple of 512 bits; 2) processes this input without padding, using the same IV and round function as SHA-256; 3) except for a special case: if the last input block is 512 bits of zero, the output is replaced by 256 bits of zero. Now, if we apply the normal SHA-256 padding to a message (making it multiple of 512 bits), then apply this function F, we have precisely SHA-256 (notice that the special case never triggers). However if we reverse the padding, we have a weak hash function (because the special case can trigger). $\endgroup$ – fgrieu Oct 3 '16 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.