Step 2. 2.1. Check the condition |M| < 512 If it is true, then go to Step 3. Else, perform the following calculations: 2.2. Calculate the subvector m belonging to V_512 of the message M: M = M'||m Then perform the following calculations:
So, this hash function process message from the end. Is this convinient in practice, when user wants to hash some big data, for example few gigabytes file, or when low CPU/RAM device wants to hash stream of data on the fly? The code have to keep entire message in buffer, and start hashing only when it receives full message.
I understand, that this approach is more secure and eliminate length extension attack, but it is very unpractical.