# blake2b length extension attack approach

I understand that a completion flag parameter with Boolean value of 1 is used by Blake2 when it’s compressing the final block of the digested message.

This ensures that one cannot load the state of a blake2 implementation with a blake2 digest and continue on (length extension attack).

However I was just thinking, given that blake2 is open source, couldn't one just create a variant of blake2 that doesn't contain the completion flag, run the original message through it to obtain a non 'completed' digest and then use this as the state to mount a length extension attack through the standard version of blake2?

Which seems so trivial, I'm surprised we consider it length extension proof.

A length extension attack means that knowing M and Hk(M), you may be able to compute Hk(M||E) without knowing the key k.
But with BLAKE2, in order to compute Hk(M) before the finalization, you would need to know the key k. If you somehow know the secret key, you can already forge tags for arbitrary messages.