# Is it possible to perform a length-extension attack if only the last bit of the new message changes?

Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows:

H(secret_key||timestamp), so that the attacker knows the result and the timestamp.


Is it possible to produce a valid MAC of H(secret_key||timestamp+1) with length-extension or other attack?

No, the length extension property does not allow to compute $H(\text{secret_key}\mathbin\|\text{timestamp}+1)$ from $H(\text{secret_key}\mathbin\|\text{timestamp})$ and $\text{timestamp}$.

Two caveats:

• That's for reasonable encoding of integers to bitstring for the $\text{timestamp}$ field, including anything fixed-size, ASN.1, Integer-to-Octet-String Conversion, and any conceivable variation. Argument: the length extension property computes the hash of a message larger than the original by the padding size (at least 65-bit for SHA-256), and further that much of the extension is heavily constrained.
• What's considered is not an intended use of $H$, and we have no convincing argument of security from other attacks. The academically sound thing is to use a MAC, for example HMAC with $\text{secret_key}$ as the key and $\text{timestamp}$ as the message.
• Thanks for your response. What I've seen in a real implementation is as follows in python2.7: data = secret_key + unix_timestamp , token_hash = hashlib.sha256(data).hexdigest(). That token_hash is being used as auth and mac. The timestamp is in seconds !. Commented Jul 22, 2018 at 0:58
• @jdcaballerob: that allows to compute $H(\text{secret_key}\mathbin\|\text{timestamp}+x)$ with probability $1-x$ when $x<1\text{ second}$ !
– fgrieu
Commented Jul 22, 2018 at 11:31