I have understood that it's trivial to reconstruct the internal state of a hasher for many hash functions, if one only knows the output hash. Then, one can append data after the original data and obtain a valid hash for the original data plus the appended data.
However, recently I became aware that hash functions including MD5, SHA1, etc. actually append the length.
If hash functions append the length, why doesn't that stop the length extension attacks? For a good hash function, if the attacker knows hash(message || length)
, there should be no way to obtain hash(message)
to be able to calculate hash(message || appended_data)
which would allow calculating hash(message || appended_data || total_length)
.
Related: Understanding the length extension attack ...although the related question doesn't discuss appending of the length which MD5, SHA1, etc. do.
hash(message || length)
mean? $\endgroup$ – Vasu Deo.S Jul 22 '19 at 18:19message || length
is mymessage <that happens to end with length>
. $\endgroup$ – TLW Jul 23 '19 at 4:32||
is sometimes used to denote string concatenation. For example many sql flavors use||
$\endgroup$ – Giacomo Alzetta Jul 23 '19 at 8:21