# Why does Merkle-Damgård hashing involve putting the padding at the end instead of at the start?

Pretty much the title. We have that $$x$$ is a prefix of $$PAD(x)$$, instead of being a suffix - was that an arbitrary choice or is there a reason for it? Thank you.

• @kelalaka I appreciate that as a general rule, padding should be suffix-free, but I am not too sure why putting the message at the end rather than the start would exacerbate the potential suffix problem? Thank you. Apr 29, 2021 at 14:08
• @kelalaka That makes sense, thank you! Apr 29, 2021 at 14:39
• OK. I've converted the comment into an asnwer. Apr 29, 2021 at 15:17

I can only provide a programming sense to this;

One may not know the size of the message beforehand (streaming), when finished, the length-padding can be executed nicely at the end. Otherwise, the system must store all of the messages to calculate the size, this will be very bad for constrained environments.

I found a solution for your problem in "Introduction to Modern Cryptography" by Jonathan Katz and Yehuda Lindell.

Unfortunately, I cannot explain it any further, since I am still a beginner myself, but maybe it helps you out:

Exercise:

Solution:

• This answer is not correct, because any prefix padding would include the length of the entire message (just as the SHA-2 suffix padding does); with such padding, $\operatorname{hash}(y) \ne \operatorname{hash}(x, y)$ (because the length in the initial padding would change, even if we were to use such an artificial compression function). Instead, the correct answer is as given by kelalaka; it would be inconvenient (and sometimes impossible) to give the total message length before we start hashing. Dec 5, 2022 at 21:57
• I second that this answer is not correct w.r.t. the question asked, and the solution in this answer is correct w.r.t. the exercise. That exercise/solution highlights the need that the IV in Merkle-Damgård is arbitrary, not that the length in MD must be in the end rather than in the IV.
– fgrieu
Dec 6, 2022 at 6:57