Linked Questions
13 questions linked to/from Understanding the length extension attack
6
votes
2
answers
2k
views
If hash functions append the length, why does length extension attack work? [duplicate]
I have understood that it's trivial to reconstruct the internal state of a hasher for many hash functions, if one only knows the output hash. Then, one can append data after the original data and ...
- 1,095
0
votes
0
answers
288
views
Why is Merkle-Damgård construction insecure? [duplicate]
I've been reading about SHA-1. I read that SHA-1 is insecure as it uses the Merkle-Damgård construction and the Merkle-Damgård construction is — according to Wikipedia — susceptible to a variety of ...
- 101
91
votes
2
answers
24k
views
What is the "Random Oracle Model" and why is it controversial?
What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else?
And why do some researchers have a strong distrust of this model?
- 3,988
10
votes
1
answer
3k
views
Why is H(message||secret_key) not vulnerable to length-extension attack?
Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$.
Why can't he perform the same ...
- 103
3
votes
1
answer
7k
views
Computing the padding of MD5
So I'm reading this question to learn more about length extension attack, and I want to make sure I understand the basics of padding.
It says in the post that given the hash and the length of the ...
- 221
7
votes
2
answers
708
views
Does a practical collision attack on a cryptographic hash function also mean it fails “indistinguishable from random data”?
It is knowns that SHA-1 has been broken in practice using collision attacks. Related to SHA-1 this mainly had a negative impact on the security of
Digital Certificate signatures
Email PGP/GPG ...
- 17.4k
4
votes
2
answers
894
views
Is whirlpool vulnerable to length extension attack?
Is whirlpool vulnerable to length extension attacks?
I did not find anything on the topic and hardly anything interesting about whirlpool at all. I am trying to build some HMAC for a program and ...
- 3,975
3
votes
1
answer
516
views
What are fixed points and length extension attack in hash functions?
I was recently reading about hash functions, and I came across fixed points (one or more fixed points, interested in both) and length extensions, but I didn't exactly understand how these work. If ...
- 1,115
1
vote
2
answers
854
views
Hash functions with variable and fixed length inputs
I was told that a hash function (mostly looking at the SHA-* family) should have input strings of variant length provided first, and those of fixed length after (ie salt), in order to avoid some kind ...
- 113
1
vote
1
answer
766
views
Solve a problem, thought it was hash length extension, hours later, am I wrong?
Here is my situation. I'm working with an application for which uses hashing to authenticate data.
I have a string, which is hashed. It is, like in a hash length extension attack, H(key:known_value)
...
1
vote
1
answer
501
views
Can I compute “SHA256(secret||data)” when having “SHA256(secret)” and “data”?
I need to find the SHA256 hash of s string like this: part1-part2. I know the SHA256(part1), length of part1 and I know ...
- 113
2
votes
1
answer
132
views
How strong if I combine two hash functions, such as MD5(SHA256(input))?
If I try to do MD5(SHA256(input)), what is the strength of this so-called double hashing approach?
Is it as strong as SHA256, or as strong as MD5, or as strong as ...
- 21
1
vote
1
answer
160
views
Cycling hashing in PBKDF's and their limitations in strength?
I hope this question isn't too similar to one that's already been asked. I also want to point out I know part the answer already, AFAIK: I just want some expert input on this.
Let's model a hash that ...
- 540