# Would changing number of rounds in last compression prevent length extension attack?

Suppose we have some Merkle–Damgård hash function. Assuming compression function supports it and is equally secure with more rounds.

Would changing number of rounds (for example doubling them) for last block cipher compression prevent length extension attack?

• In theory, a Merkle-Damgård hash function does not necessarily use rounds. And it's compression function comes in several common structures, none of which with a direct notion of rounds. Do you mean more rounds in some iterated encryption function of the Davies-Meyer compression function of some Merkle-Damgård hash function?
– fgrieu
Sep 6 at 19:33
• @fgrieu I had Matyas-Meyer-Oseas in mind. Sep 6 at 20:41
• At least Matyas-Meyer-Oseas specifies the XOR (that the counter example in my answer needs to remove), and in that is similar to Davies-Meyer. And the extra block compared to Davies-Meyer seems to further guard against attack. But "more rounds" remains quite vague, even if we assume the block cipher used has rounds. Thus I'd better be safe than sorry and make no certain statement until further precisions.
– fgrieu
Sep 6 at 20:51
• We can assume block cipher has different round constants for every round. Simply calling block cipher twice I know would not work as it would be the same as adding zeros on message end. Another possibility might be to do $E_0(h) \oplus h$ (on end switch to Davies-Meyer and using all zero key to mask output). Sep 6 at 21:10