What is the rationale for the difference between MD5 and SHA-3 padding schemes?

  • MD5 appends 10* and then the 64-bit message length in bits.
  • SHA-3 appends 10*1.

Why do they use different padding schemes? MD5 is based on the Merkle-Damgard construction, while SHA-3 is based on the sponge construction—is this relevant?


1 Answer 1


From the Keccak Team:

When a padding rule is used with particular properties, one can securely instantiate sponge functions with different rates with the same fixed-length permutation. The simplest padding rule satisfying these properties is called the multi-rate padding: it appends a single 1-bit, then a variable number of zeroes and finally another 1-bit.

So the goal was to make a padding construct that worked with all variations of Keccak, including those that became standardized as SHA-3. The approach keeps those variants prefix-free and as simple and similar as possible to aid cryptanalysis.

The length of the input is included implicitly in the state of Keccak based on the number of calls to the permutation and the padding value. Encoding the input length simply isn’t needed in Keccak, so it was omitted.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.