12 questions linked to/from Understanding the length extension attack
2k views

### If hash functions append the length, why does length extension attack work? [duplicate]

I have understood that it's trivial to reconstruct the internal state of a hasher for many hash functions, if one only knows the output hash. Then, one can append data after the original data and ...
242 views

### Why is Merkle-Damgård construction insecure? [duplicate]

I've been reading about SHA-1. I read that SHA-1 is insecure as it uses the Merkle-Damgård construction and the Merkle-Damgård construction is — according to Wikipedia — susceptible to a variety of ...
19k views

### What is the “Random Oracle Model” and why is it controversial?

What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else? And why do some researchers have a strong distrust of this model?
3k views

### Why is H(message||secret_key) not vulnerable to length-extension attack?

Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$. Why can't he perform the same ...
6k views

### Computing the padding of MD5

So I'm reading this question to learn more about length extension attack, and I want to make sure I understand the basics of padding. It says in the post that given the hash and the length of the ...
779 views

### Is whirlpool vulnerable to length extension attack?

Is whirlpool vulnerable to length extension attacks? I did not find anything on the topic and hardly anything interesting about whirlpool at all. I am trying to build some HMAC for a program and ...
568 views

### Does a practical collision attack on a cryptographic hash function also mean it fails “indistinguishable from random data”?

It is knowns that SHA-1 has been broken in practice using collision attacks. Related to SHA-1 this mainly had a negative impact on the security of Digital Certificate signatures Email PGP/GPG ...
437 views

### What are fixed points and length extension attack in hash functions?

I was recently reading about hash functions, and I came across fixed points (one or more fixed points, interested in both) and length extensions, but I didn't exactly understand how these work. If ...
527 views

### Hash functions with variable and fixed length inputs

I was told that a hash function (mostly looking at the SHA-* family) should have input strings of variant length provided first, and those of fixed length after (ie salt), in order to avoid some kind ...
680 views

### Solve a problem, thought it was hash length extension, hours later, am I wrong?

Here is my situation. I'm working with an application for which uses hashing to authenticate data. I have a string, which is hashed. It is, like in a hash length extension attack, H(key:known_value) ...