I've searched a bit for this question, but I haven't found anything, so I've decided to post it here.
Lately I've been reading "Serious Cryptography: A Practical Introduction to Modern Encryption" by Aumasson. In chapter 6 he talks about Hash Functions and as examples, of what can go wrong, he explains the "length extension attack" and "fooling proof-of-storage protocols". He explains that, for example BLAKE2 isn't vulnerable to the first attack because it includes a flag that if it's the last block, it does some things different, so the output cannot be used as the entry for next blocks.
Then he explains the proof-of-storage protocols, namely:
- The client picks a random value, C, as a challenge.
- The server computes Hash(M || C) as a response and sends the result to the client.
- The client also computes Hash(M || C) and checks that it matches the value received from the server.
And why it should be Hash(C || M) instead:
The premise of the paper is that the server shouldn’t be able to fool the client because if the server doesn’t know M, it can’t guess Hash(M || C). But there’s a catch: in reality, Hash will be an iterated hash that processes its input block by block, computing intermediate chaining values between each block. For example, if Hash is SHA-256 and M is 512 bits long (the size of a block in SHA-256), the server can cheat. How? The first time the server receives M, it computes H1 = Compress(H0, M1), the chaining value obtained from SHA-256’s initial value, H0, and from the 512-bit M. It then records H1 in memory and discards M, at which point it no longer stores M. Now when the client sends a random value, C, the server computes Compress(H1, C), after adding the padding to C to fill a complete block, and returns the result as Hash(M || C). The client then believes that, because the server returned the correct value of Hash(M || C), it holds the complete message—except that it may not, as you’ve seen.
My first question, maybe a stupid one, is: Why would the server do that? Why "fool" the client?
And the second one, how is that different from a length extension attack? to which BLAKE2 is not vulnerable, but it is for this one?
Thanks a lot! :)