Pretty much the title. We have that $x$ is a prefix of $PAD(x)$, instead of being a suffix - was that an arbitrary choice or is there a reason for it? Thank you.

  • $\begingroup$ @kelalaka I appreciate that as a general rule, padding should be suffix-free, but I am not too sure why putting the message at the end rather than the start would exacerbate the potential suffix problem? Thank you. $\endgroup$ Apr 29, 2021 at 14:08
  • $\begingroup$ @kelalaka That makes sense, thank you! $\endgroup$ Apr 29, 2021 at 14:39
  • $\begingroup$ OK. I've converted the comment into an asnwer. $\endgroup$
    – kelalaka
    Apr 29, 2021 at 15:17

2 Answers 2


I can only provide a programming sense to this;

One may not know the size of the message beforehand (streaming), when finished, the length-padding can be executed nicely at the end. Otherwise, the system must store all of the messages to calculate the size, this will be very bad for constrained environments.


I found a solution for your problem in "Introduction to Modern Cryptography" by Jonathan Katz and Yehuda Lindell.

Unfortunately, I cannot explain it any further, since I am still a beginner myself, but maybe it helps you out:

Exercise: Exercise

Solution: Solution

  • 4
    $\begingroup$ This answer is not correct, because any prefix padding would include the length of the entire message (just as the SHA-2 suffix padding does); with such padding, $\operatorname{hash}(y) \ne \operatorname{hash}(x, y)$ (because the length in the initial padding would change, even if we were to use such an artificial compression function). Instead, the correct answer is as given by kelalaka; it would be inconvenient (and sometimes impossible) to give the total message length before we start hashing. $\endgroup$
    – poncho
    Dec 5, 2022 at 21:57
  • 1
    $\begingroup$ I second that this answer is not correct w.r.t. the question asked, and the solution in this answer is correct w.r.t. the exercise. That exercise/solution highlights the need that the IV in Merkle-Damgård is arbitrary, not that the length in MD must be in the end rather than in the IV. $\endgroup$
    – fgrieu
    Dec 6, 2022 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.