# Length extension attacks, Merkle–Damgård constructions, and HMACs

The wikipedia page for Length Extension Attacks says "Note that since HMAC doesn't use [Merkle–Damgård constructions], HMAC hashes are not prone to length extension attacks."

However, HMACs can be constructed with hashing algorithms such as MD-5, SHA-1, and SHA-256 which use these constructions. I understand that HMACs are secure even when constructed from these hashing algorithms, but is it accurate to say that HMACs don't use Merkle–Damgård constructions? And if so, why not?

When a Merkle–Damgård based hash is misused as a message authentication code with construction $$H(\mathrm{secret} ‖ \mathrm{message})$$, and message and the length of secret is known, a length extension attack allows anyone to include extra information at the end of the message and produce a valid hash without knowing the secret. Note that since HMAC doesn't use this construction, HMAC hashes are not prone to length extension attacks.