5
$\begingroup$

According to RFC 1321 § 3.2 (MD5), the length of the message ($b$) is encoded as $b \bmod 2^{64}$:

A 64-bit representation of b (the length of the message before the
padding bits were added) is appended to the result of the previous
step. In the unlikely event that b is greater than 2^64, then only
the low-order 64 bits of b are used. (These bits are appended as two
32-bit words and appended low-order word first in accordance with the
previous conventions.)

This is contrasted with other Merkle–Damgård functions like SHA-1 which, despite also using a 64-bit representation of message length, are simply undefined for messages larger than that. Obviously this is a massive amount of data and there is no reason anyone would ever hash a message of that size, but I am still curious about the theoretical implications of this design decision that is no longer used.

This question was inspired by Does a hash function necessarily need to allow arbitrary length input?.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.