In preparing an input for SHA256 or RIPEMD-160 a single bit (1) is appended to the message before adding any necessary zero padding and before adding the bitlength (64 bits) to form 1 or more 512 bit blocks. What is the purpose of adding the single bit (1)?

  • 1
    $\begingroup$ Actually, that padding format goes back to (at least) MD4... $\endgroup$ – poncho Aug 22 '18 at 0:45
  • $\begingroup$ @poncho I've been told that the single big is known as an injective and somehow prevents potential collisions due to padding, however, I can't figure out why the padding (if necessary) before the bitlength (given two different inputs) could create a collision which would make the injective necessary. $\endgroup$ – JohnGalt Aug 22 '18 at 14:33
  • 2
    $\begingroup$ If there is a weakness due to a single bit, I would expect that weakness could be exploited to generate a collision/second preimage at an intermediate step (and hence produce a collision/second preimage at the final step, by leaving the rest of the message the same). I can see the point in including the message length (otherwise, if someone finds a way back to the IV, that leads to immediate collisions); I don't know the reason for also including the bit. $\endgroup$ – poncho Aug 22 '18 at 17:29

If you look at the Wikipedia on padding article page, you will see many different ideas.

The main problem when designing a padding, firstly, one has to consider how to eliminate the padding correctly, all the time. It is the designer's choice, as noted in and the original RFC 4634 -- SHA and HMAC-SHA.

Once you put 1 followed by many 000 to the end of a string, you can remove the padding by looking the first position of a single 1 from the end. That was the simplest idea for padding, AFAIK.

When considering that hashes only supply integrity, If finding a collusion is easy with this (or any) padding than the hash is already failed there.

| improve this answer | |
  • $\begingroup$ This makes sense otherwise, but the padding also includes the length of the message, so being able to strip the $1|0^n$ part on its own is not required. The extra 1-bit seems unnecessary and in the worst case causes an extra block to be processed. $\endgroup$ – otus Sep 9 '18 at 7:32
  • $\begingroup$ if the message length is zero, they include the 1 to make the computations easier? "000...0". So how to determine the message and size easily. $\endgroup$ – kelalaka Sep 9 '18 at 8:16
  • 1
    $\begingroup$ The last 64/128 bits (depending on which hash we are talking about) are always the message length. So you can determine it just by looking at that value. $\endgroup$ – otus Sep 9 '18 at 8:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.