# Is it possible to perform a length-extension attack if only the last bit of the new message changes?

Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows:

H(secret_key||timestamp), so that the attacker knows the result and the timestamp.


Is it possible to produce a valid MAC of H(secret_key||timestamp+1) with length-extension or other attack?

No, the length extension property does not allow to compute $H(\text{secret_key}\mathbin\|\text{timestamp}+1)$ from $H(\text{secret_key}\mathbin\|\text{timestamp})$ and $\text{timestamp}$.
• That's for reasonable encoding of integers to bitstring for the $\text{timestamp}$ field, including anything fixed-size, ASN.1, Integer-to-Octet-String Conversion, and any conceivable variation. Argument: the length extension property computes the hash of a message larger than the original by the padding size (at least 65-bit for SHA-256), and further that much of the extension is heavily constrained.
• What's considered is not an intended use of $H$, and we have no convincing argument of security from other attacks. The academically sound thing is to use a MAC, for example HMAC with $\text{secret_key}$ as the key and $\text{timestamp}$ as the message.
• @jdcaballerob: that allows to compute $H(\text{secret_key}\mathbin\|\text{timestamp}+x)$ with probability $1-x$ when $x<1\text{ second}$ !