# Length extension attacks, Merkle–Damgård constructions, and HMACs

The wikipedia page for Length Extension Attacks says "Note that since HMAC doesn't use [Merkle–Damgård constructions], HMAC hashes are not prone to length extension attacks."

However, HMACs can be constructed with hashing algorithms such as MD-5, SHA-1, and SHA-256 which use these constructions. I understand that HMACs are secure even when constructed from these hashing algorithms, but is it accurate to say that HMACs don't use Merkle–Damgård constructions? And if so, why not?

## 1 Answer

Your quote is wrong:

The wikipedia page for Length Extension Attacks says "Note that since HMAC doesn't use [Merkle–Damgård constructions], HMAC hashes are not prone to length extension attacks."

The part that you've paraphrased in square brackets is a misreading of the original, which reads (my boldface):

When a Merkle–Damgård based hash is misused as a message authentication code with construction $$H(\mathrm{secret} ‖ \mathrm{message})$$, and message and the length of secret is known, a length extension attack allows anyone to include extra information at the end of the message and produce a valid hash without knowing the secret. Note that since HMAC doesn't use this construction, HMAC hashes are not prone to length extension attacks.

The antecedent of "this construction" in the final sentence isn't the Merkle–Damgård construction, but rather the secret prefix MAC construction.

• Thank you! As a followup, a TA in my cryptography course stated "HMAC does not use Merkle-Damgard." There is no additional context. Is this incorrect for the reasons I stated in my original question? – Prime Feb 21 at 1:20
• @Prime: I'd say it's true in a similar sense that, to use a potentially tortured analogy, cheesecake recipes use cheese but don't use rennet (a common but not obligatory ingredient in cheesemaking). – Luis Casillas Feb 21 at 22:04