# Is length extension attack considered as collision?

I came across a few articles about length extension attacks on cryptographic hash functions. I was very surprised to read that SHA-256 and SHA-512 are prone to length extension attacks. This seems contradictory to the fact that—to the best of my knowledge—there are no known collisions on these algorithms.

According to the comparison of SHA functions table from Wikipedia the capacity against length extension attacks is 0 for both SHA-256 and SHA-512 which should mean that this attack does not require much computing resources.

Aren't length extension attacks considered as collisions as well?

• Length extension attacks are conditional collisions. So assuming you know one collision, the length extension attack allows you to construct arbitrarily many out of that one.
– SEJPM
Nov 19 '19 at 13:01
• Can you define conditional collision? Does assuming you know one collision mean that the length extension attack is still impractical for SHA-2? Nov 19 '19 at 13:48

The length extension property is that given the hash of a bitstring $$M$$ of given length $$l$$ (but arbitrary and unknown content), it is possible to compute the hash of $$M\mathbin\|F(l)\mathbin\|E$$ with $$F(l)$$ a short bitstring deduced from the length of $$l$$, and any known bitstring $$E$$.
It follows that if messages $$M$$ and $$M'$$ of the same length collide (have the same hash even though $$M\ne M'$$), then $$M\mathbin\|F(l)\mathbin\|E$$ and $$M'\mathbin\|F(l)\mathbin\|E$$ also collide. Therefore, the length extension property eases building more collisions from an existing collision among messages of the same length.