# Different literature padding for Merkle-Damgard

I don't think this question addresses what I want to ask. I was taught that the Merkle Damgard scheme worked as in this picture:

Here I assume that we are inserting a pad in filling the last block of the message. Probably, we set a new block if all blocks are full. This is a particular case for SHA1 but I don't think it makes a difference.

However, in the book Introduction to Cryptography by Hans Delf and Helmut Knebl they propose the following scheme:

If one has a function $f:\mathcal{B}^{N+r} \rightarrow \mathcal{B}^N$ and wants $h:\mathcal{B}^{*} \rightarrow \mathcal{B}^N$ then one takes $m \in \mathcal{B}^{*}$ and proceeds as follows:

$m' = m||1000 \cdots \in \mathcal{B}^{kr}$ where you add enough zeros to complete the block. Then one divides $m' = m_1||m_2||\cdots||m_k$ with $m_i \in \mathcal{r}$ and adds a block $m_{k+1}$ which contains the initial size of $m$ with the rest of the block filled with zeros.

What I ask for

I could go probably to Merkle and Damgard's original paper. But I don't know if their padding scheme was ok since I see that there has been some discussions on it. So I ask, are this paddings schemes both correct or has any of them proved insecure?

## 1 Answer

The customary (and secure) padding is the one you have been taught: at the end of the message add a single 1 bit, then just enough (possibly none) 0 bit(s) to reach the end of a block less the size devoted to the length (64-bit before the 512-bit limit for MD5, SHA-1, and SHA-256; 128-bit before the 1024-bit limit for SHA-512); then add the length (little-endian for MD5, big-endian for SHA-x).

The padding that you describe based on Hans Delf and Helmut Knebl is equally secure, but often uses one more block than the other.