I don't think this question addresses what I want to ask. I was taught that the Merkle Damgard scheme worked as in this picture:enter image description here

Here I assume that we are inserting a pad in filling the last block of the message. Probably, we set a new block if all blocks are full. This is a particular case for SHA1 but I don't think it makes a difference.

However, in the book Introduction to Cryptography by Hans Delf and Helmut Knebl they propose the following scheme:

If one has a function $f:\mathcal{B}^{N+r} \rightarrow \mathcal{B}^N$ and wants $h:\mathcal{B}^{*} \rightarrow \mathcal{B}^N$ then one takes $m \in \mathcal{B}^{*}$ and proceeds as follows:

$m' = m||1000 \cdots \in \mathcal{B}^{kr}$ where you add enough zeros to complete the block. Then one divides $m' = m_1||m_2||\cdots||m_k$ with $m_i \in \mathcal{r}$ and adds a block $m_{k+1}$ which contains the initial size of $m$ with the rest of the block filled with zeros.

What I ask for

I could go probably to Merkle and Damgard's original paper. But I don't know if their padding scheme was ok since I see that there has been some discussions on it. So I ask, are this paddings schemes both correct or has any of them proved insecure?


The customary (and secure) padding is the one you have been taught: at the end of the message add a single 1 bit, then just enough (possibly none) 0 bit(s) to reach the end of a block less the size devoted to the length (64-bit before the 512-bit limit for MD5, SHA-1, and SHA-256; 128-bit before the 1024-bit limit for SHA-512); then add the length (little-endian for MD5, big-endian for SHA-x).

The padding that you describe based on Hans Delf and Helmut Knebl is equally secure, but often uses one more block than the other.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.