It always seemed to me that length extensions are possible simply because no special operation is performed after the last operation - for instance in a Merkle-Damgård construction. Basically the MD construction makes sure that the hash state is secure after processing each block, and therefore the hash state can be directly used as the output of the hash function.
All the bits in the state should depend on all the input bits. That should mean that it will be as hard to find a hash with a short Hamming distance to an existing hash value as to find a hash with a much larger Hamming distance.
So if this reasoning is correct then any operation that:
- doesn't affect the security of the hash;
- cannot be reduced to the operation performed on each block;
should be able to turn a hash that allows length extension attacks to a hash that doesn't allow length extension attacks.
Questions:
- Any problem with my reasoning? Is any bit flip enough for the full output of the hash (see note below)?
- If it is that simple, is there any reason why it hasn't been performed on SHA-2? Were length extension attacks unknown or not seen as a problem?
- Would such a stupidly simple construction be an viable alternative to HMAC (with $K \| M$ as input message and a static size of $K$)?
Note: Flipping a single bit could do the trick if my reasoning is correct, but it has the drawback that partial hashes may not be affected. Flipping every bit - to get the complement of the hash value - should work as well - I think.