2
$\begingroup$

If I have a very large input to hash with a hash function vulnerable to length extention and I am using a hash list, should I HMAC each part of the input or just HMAC the final hash of all the hashes ? If i do need to HMAC everything, should I use a different key for each hash ?

$\endgroup$
3
  • $\begingroup$ the hash list is not clear, SHA512-256 (a variant of SHA2)is not vulnerable to length extension. $\endgroup$
    – kelalaka
    Jul 28, 2020 at 22:22
  • $\begingroup$ Why do you insist on using a hash function vulnerable to length extension, use SHA3, done. $\endgroup$
    – kelalaka
    Jul 28, 2020 at 22:37
  • $\begingroup$ SHA-3 is slower than SHA-2 (for software) $\endgroup$ Jul 29, 2020 at 16:51

1 Answer 1

2
$\begingroup$

You can just use a hash tree with a pre-configured node size then only the last hash value would be vulnerable to a length extension attack. In that sense this is not that different from performing a HMAC over a single hash.

However, that's kind of besides the point. A length extension attack is only applicable for keyed hashes. As the hashes are not keyed yet, length extension attacks don't apply.

So yes, you can simply perform HMAC over the final hash (or final hash set if you are using a Merkle tree, and you want to minimize the depth of the tree). By that the hash value must remain the same as otherwise the HMAC verification will fail.

If the hash value remains the same it obviously is protected against length extension attacks; length extension attacks alter the final hash value while still representing a valid keyed hash.

$\endgroup$
2
  • $\begingroup$ I don't understand your last sentence. $\endgroup$ Jul 29, 2020 at 16:54
  • $\begingroup$ Does this explain it better? $\endgroup$
    – Maarten Bodewes
    Jul 29, 2020 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.