Linked Questions

0
votes
1answer
1k views

What is the exact purpose of length padding in Merkle–Damgård hash functions? [duplicate]

Is a length padding technique in a hash function used to avoid length extension attacks ?
2
votes
0answers
47 views

Why do we need Merkle–Damgård strengthening [duplicate]

Reading through some manuals, wikis and other documentation I'm learning about Merkle–Damgård construction. I understand why padding beginning with '1', followed by '0's is needed, but I can't ...
11
votes
4answers
2k views

Why is SHA-512 limited to an input of $2^{128}$ bits?

Both SHA-384 and SHA-512 are limited to an input size of less than $2^{128}$ bits. Considering SHA-512 has a higher output size, couldn't it include more input data?
7
votes
2answers
2k views

Does a hash function have a Upper bound on input length?

I came across this Answer stating (just a line from the answer):- The input space is "infinite" and thus it has an infinite amount of values that will collide into a single hash And in the ...
2
votes
1answer
757 views

Why the $IV$ used in Merkle–Damgård has to be fixed to a specific value?

I just can't figure out why on earth the $IV$ in Merkle–Damgård has to be fixed (that's what the Katz-Lindell book says)? Because even if you choose it randomly from say $\{{0,1}\}^n$ then the ...
8
votes
1answer
709 views

Why does SHA-2 call for doing 10* padding in addition to appending the message length?

Appending the length of the message when padding of a SHA-2 message is sufficient to satisfy the Merkle-Damgård construction. However the padding in SHA-2 also pads with 10* between the end of the ...
3
votes
3answers
505 views

What do we gain from hashing the length in Merkle–Damgård?

Assuming our fixed compression function $h$ works for inputs of length $i(n)$ and output strings of length $o(n)$, if $2o(n) < i(n)$, why do we need to calculate $h(z_B||L)$ where L is the input's ...
1
vote
1answer
295 views

Confused about Merkle Damgard Transform - short messages?

With the Merkle Damgard Transform, how does it handle messages that are shorter than the input message length - hash digest length? Or in other words, how is the last block handled? So for example, if ...
0
votes
1answer
273 views

Md compliment padding

What padding algorithms are there that are MD-compliment so two different inputs don't pad to the same thing? Which would cause a collision in a hash function.
2
votes
1answer
205 views

Why do you need padding block at the end of Merkle damgard if the input is multiple of block length?

Why do you need padding block at the end of Merkle Damgard if the input is multiple of block length? I learned that it was not collision resistant if a dummy block is not added to the end but I want ...
2
votes
1answer
196 views

Why does FIPS 180-4 require the final padding block start with a 1?

From FIPS 180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length: Suppose that the ...