I've been reading about SHA-1. I read that SHA-1 is insecure as it uses the Merkle-Damgård construction and the Merkle-Damgård construction is — according to Wikipedia — susceptible to a variety of attacks. However, I have not been able to come up with a single example of how these work.

Can someone give me an example of a length extension attack?

  • 1
    $\begingroup$ skullsecurity.org/blog/2012/… explains it pretty well. $\endgroup$
    – orlp
    Aug 8, 2013 at 1:56
  • 3
    $\begingroup$ I think you, to some extent, misinterpreted the wikipedia entry. The fact that Merkle-Damgård has certain potentially undesirable features, does not per se imply that SHA-1 (or any other MD hash) is insecure. It just means that some care has to be taken when using MD hashes as building blocks for higher level schemes. $\endgroup$ Aug 8, 2013 at 1:59
  • $\begingroup$ I see what you mean. Don't use Merkle-Damgard. Use an enhanced/modified version. But there has to be some major reason why NIST decided to come up with SHA-2 and SHA-3 subsequently. Surely, if being careful while implementing/using SHA-1 solved the problem of security, we wouldn't need SHA-2/SHA-3? I did read somewhere that SHA-2 also uses the Merkle-Damgard construction and there have been theoretical attacks against it. But I still haven't read much about SHA-2. So I still don't know why it is better than SHA-1. $\endgroup$
    – Prachi
    Aug 8, 2013 at 2:25
  • 1
    $\begingroup$ Found another useful link that explains Length Extension Attack: crypto.stackexchange.com/questions/3978/… $\endgroup$
    – Prachi
    Aug 8, 2013 at 2:48
  • 2
    $\begingroup$ Possible dup: crypto.stackexchange.com/q/3978/351 $\endgroup$
    – D.W.
    Aug 8, 2013 at 4:25


Browse other questions tagged or ask your own question.