According to RFC 1321 § 3.2 (MD5), the length of the message ($b$) is encoded as $b \bmod 2^{64}$:

A 64-bit representation of b (the length of the message before the
padding bits were added) is appended to the result of the previous
step. In the unlikely event that b is greater than 2^64, then only
the low-order 64 bits of b are used. (These bits are appended as two
32-bit words and appended low-order word first in accordance with the
previous conventions.)

This is contrasted with other Merkle–Damgård functions like SHA-1 which, despite also using a 64-bit representation of message length, are simply undefined for messages larger than that. Obviously this is a massive amount of data and there is no reason anyone would ever hash a message of that size, but I am still curious about the theoretical implications of this design decision that is no longer used.

This question was inspired by Does a hash function necessarily need to allow arbitrary length input?.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.