2
$\begingroup$

If I have a very large input to hash with a hash function vulnerable to length extention and I am using a hash list, should I HMAC each part of the input or just HMAC the final hash of all the hashes ? If i do need to HMAC everything, should I use a different key for each hash ?

$\endgroup$
3
  • $\begingroup$ the hash list is not clear, SHA512-256 (a variant of SHA2)is not vulnerable to length extension. $\endgroup$ – kelalaka Jul 28 '20 at 22:22
  • $\begingroup$ Why do you insist on using a hash function vulnerable to length extension, use SHA3, done. $\endgroup$ – kelalaka Jul 28 '20 at 22:37
  • $\begingroup$ SHA-3 is slower than SHA-2 (for software) $\endgroup$ – moutonlapin28 Jul 29 '20 at 16:51
2
$\begingroup$

You can just use a hash tree with a pre-configured node size then only the last hash value would be vulnerable to a length extension attack. In that sense this is not that different from performing a HMAC over a single hash.

However, that's kind of besides the point. A length extension attack is only applicable for keyed hashes. As the hashes are not keyed yet, length extension attacks don't apply.

So yes, you can simply perform HMAC over the final hash (or final hash set if you are using a Merkle tree, and you want to minimize the depth of the tree). By that the hash value must remain the same as otherwise the HMAC verification will fail.

If the hash value remains the same it obviously is protected against length extension attacks; length extension attacks alter the final hash value while still representing a valid keyed hash.

$\endgroup$
2
  • $\begingroup$ I don't understand your last sentence. $\endgroup$ – moutonlapin28 Jul 29 '20 at 16:54
  • $\begingroup$ Does this explain it better? $\endgroup$ – Maarten Bodewes Jul 29 '20 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.