Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc".

(In PHP: hash('sha256', $unknownString .'abc');)

I thought in order to do so "all I need" is to go from the hash that I know back to the midstate of the sha256 algorithm (in most implementations called finalize) and append the data that I want (via, in most implementations called, update) and then call finalize again. Block lengths shouldn't be a problem because the unknown string has a length of 256 bit and my own string has this as well.

Is this possible or by the way sha256 is designed impossible to achieve?

PS: I have no intention in getting the unknown string. I absolutely do not care about the plaintext contents of this.

  • $\begingroup$ Thanks @poncho for the added keyword. I did not know this was called like that and I think I found exactly what I wanted. Thanks! $\endgroup$
    – jabbink
    Jun 24, 2013 at 22:31
  • 1
    $\begingroup$ related: md5: is reverse length-extension attack possible? $\endgroup$ Jun 24, 2013 at 22:37
  • 1
    $\begingroup$ @jabbink: Hopefully, you found that the answer to your question is: no (by any known method), for the extension abc; but yes for some slightly longer extensions (possibly ending in abc), and assuming the length of $unknownString is known. $\endgroup$
    – fgrieu
    Jun 25, 2013 at 5:15

1 Answer 1


SHA-256 is computed by first padding a message $m$ and then breaking $\operatorname{pad}(m)$ into $\ell$ blocks $m_1, m_2, \dots, m_\ell$ of 512 bits each. The padding appends some bits to the message so that it is an integral multiple of 512 bits long. Then the SHA-256 hash of $m$ is $$f(\cdots f(f(\mathit{iv}, m_1), m_2) \cdots, m_\ell)$$ where $f$ is the SHA-256 compression function and $\mathit{iv}$ is the standard initialization vector. This means that given $\operatorname{SHA256}(m)$ you can compute $\operatorname{SHA256}(\operatorname{pad}(m) \mathbin\| m')$ for any suffix $m'$. But you can't necessarily compute $\operatorname{SHA256}(m \mathbin\| m'')$ unless $m''$ coincides with the padding on $m$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.