# Length extension attack SHA-1 message division with padding problem?

I'm was reading this example for length extension attack given here link

When working out, how the extended block length be divisible by 512 (SHA block size).

I'm assuming following:-

• In SHA, the size of the blocks is 512 bit.
• The last block must contain:the rest of data in message (mod 512).
• some filling (padding)
• the last 64 bits as length

In example given in link shared above, this is what extended msg looks like

http://example.com/downloadfile=report.pdf%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%A8/../../../../../../../etc/passwd&mac=ee40aa8ec0cfafb7e2ec4de20943b673968857a5

Example 1 Calculating

A more precise of asking is that,
message =10 bytes = 80 bits
secret key = 11 bytes= 88 bits
168 mod 512= 160 bits= 21 bytes
64 - 21= 43
padding +message length= 464+552 =1016 bits
adding /../../../../../../../etc/passwd 32 x 8= 256 bits
Adding it to A8/=  424

How I make sense If I add the missing padding which is 256 mod 512 =256=32 bytes

64-32  = 32 x8= 256 bits


Example 2

count=10&lat=37.351&user_id=1&long=-119.827&waffle=eggo\x80\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x02\x28&waffle=liege

Going on by logic

• message =55 bytes = 440 bits
• secret key = 14 bytes= 112 bits
• length encoding = 552
• 552 mod 512= 40 bits= 5 bytes
• 64 - 5= 59 bytes If you check the padding its 58 bytes not 59 . Can you tell why?

• padding +message length= 472+552 =1024 bits

• adding extra &waffle=liege 13 x 8= 104
• adding to existing message length(552) + 104= 656
• How I make sense If I add the missing padding which is 656 mod 512 =144 = 18 bytes
• 64 - 18= 46 x 8 = 368 bits
• 104 + 368 (message length and padding)

## 1 Answer

OK, lets go through this step by step:

1. the message size of http://example.com/downloadfile=report.pdf is 10 bytes, as only the filename (report.pdf) is hashed according to the article;
2. the key size is usually known and was explicitly set in the article to 11 bytes, not 15 (11 bytes is a bit short for a key size, by the way);
3. so the length of the message is 10 + 11 = 21 bytes, or 168 bits and A8 is indeed 168;
4. to the padding + length encoding needs to be 64 - 21 = 43 bytes, lets check that:
%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%A8
yep, that seems to be correct.

Note that 64 bytes is 512 bits for the block size and that e.g. %80 is the encoding of a single byte with value 80h, so you need to count the characters and then divide by 3.

So I'm not sure how you got your input values for the message size and key size, but they are way off. So you would not end up with the right values, regardless of the correctness of your formulas.

• Sorry, I needed some edits to make sure that I explain the things I take for granted by now. May 29, 2017 at 20:08
• +1, thanks at least someone came to rescue is 448 mod 512 e.g you minus form 64 should it not be from 448. The reason they are off, is that I copied from a another example and put it in this question. My bad let me correct it. May 29, 2017 at 20:28
• %00 represents only one byte. If you were to something in Python like len("%00"), it would return 3, because it's counting the characters %, 0, and 0 separately, and it thinks it's 3 bytes. So you need to count the number of characters and divide by 3 when a byte is represented that way.
– user47922
May 29, 2017 at 20:49
• Copy paste problem it seems, sorry, let me correct that...Now it is 129 again, I think I cut the last byte (3 characters) instead of copying it. May 29, 2017 at 21:57
• Anything may be added after %A8, the original padding and length encoding - the usual SHA-1 padding and length encoding should be added after that. You just have to add the length of the extension in bits to the one you already calculated (A8h). May 29, 2017 at 22:38