1
$\begingroup$

Is there any hash function where both $\text{hash}(m\|k)$ and $\text{hash}(k\|m)$ are vulnerable to length extension, but $\text{hash}(m)$ is itself secure?

$\endgroup$
  • $\begingroup$ Related question here about SHA-256. Maybe somebody would mind answering instead of relying on comments / hints? $\endgroup$ – Maarten Bodewes Aug 15 '18 at 22:06
  • $\begingroup$ A simple Merkle tree should meet the requirement s. $\endgroup$ – CodesInChaos Aug 15 '18 at 22:13
1
$\begingroup$

I think here it helps to examine the nature of length extension attacks, which have to do with the fact that practical hash functions are iterative. They break up their input into a sequence of fixed-size blocks, and process each block successively, using the state produced by processing the previous block as an input into the processing of its successor.

Length extensions weaknesses exist because some hash functions are (mis?)designed so that their output reveals their state after processing the final block, and that allows the attacker to shortcut the computation of the hash result for messages whose block sequence extends that of the original.

One straightforward observation is that there while the most practical way to build such a hash function would be to process blocks in the same order they occur in the input message, there is no theoretical requirement to do so. You could write a hash function that works exactly like SHA-256 but processes messages in reverse order. It would be impractical because you would need to buffer whole messages in memory or in disk before you can hash them.

The fact that hash functions are vulnerable to length extensions at the end of a message but not at the beginning is just an artifact of that practical decision to process messages from start to end.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.