Step 2.
2.1. Check the condition |M| < 512
If it is true, then go to Step 3.
Else, perform the following calculations:
2.2. Calculate the subvector m belonging to V_512 of the message
M:
M = M'||m
Then perform the following calculations:
So, this hash function process message from the end. Is this convinient in practice, when user wants to hash some big data, for example few gigabytes file, or when low CPU/RAM device wants to hash stream of data on the fly? The code have to keep entire message in buffer, and start hashing only when it receives full message.
I understand, that this approach is more secure and eliminate length extension attack, but it is very unpractical.