Linked Questions

6 votes
2 answers
2k views

If hash functions append the length, why does length extension attack work? [duplicate]

I have understood that it's trivial to reconstruct the internal state of a hasher for many hash functions, if one only knows the output hash. Then, one can append data after the original data and ...
user avatar
  • 1,095
0 votes
0 answers
288 views

Why is Merkle-Damgård construction insecure? [duplicate]

I've been reading about SHA-1. I read that SHA-1 is insecure as it uses the Merkle-Damgård construction and the Merkle-Damgård construction is — according to Wikipedia — susceptible to a variety of ...
user avatar
  • 101
91 votes
2 answers
24k views

What is the "Random Oracle Model" and why is it controversial?

What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else? And why do some researchers have a strong distrust of this model?
user avatar
  • 3,988
10 votes
1 answer
3k views

Why is H(message||secret_key) not vulnerable to length-extension attack?

Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$. Why can't he perform the same ...
user avatar
  • 103
3 votes
1 answer
7k views

Computing the padding of MD5

So I'm reading this question to learn more about length extension attack, and I want to make sure I understand the basics of padding. It says in the post that given the hash and the length of the ...
user avatar
7 votes
2 answers
708 views

Does a practical collision attack on a cryptographic hash function also mean it fails “indistinguishable from random data”?

It is knowns that SHA-1 has been broken in practice using collision attacks. Related to SHA-1 this mainly had a negative impact on the security of Digital Certificate signatures Email PGP/GPG ...
user avatar
  • 17.4k
4 votes
2 answers
894 views

Is whirlpool vulnerable to length extension attack?

Is whirlpool vulnerable to length extension attacks? I did not find anything on the topic and hardly anything interesting about whirlpool at all. I am trying to build some HMAC for a program and ...
user avatar
3 votes
1 answer
516 views

What are fixed points and length extension attack in hash functions?

I was recently reading about hash functions, and I came across fixed points (one or more fixed points, interested in both) and length extensions, but I didn't exactly understand how these work. If ...
user avatar
  • 1,115
1 vote
2 answers
854 views

Hash functions with variable and fixed length inputs

I was told that a hash function (mostly looking at the SHA-* family) should have input strings of variant length provided first, and those of fixed length after (ie salt), in order to avoid some kind ...
user avatar
1 vote
1 answer
766 views

Solve a problem, thought it was hash length extension, hours later, am I wrong?

Here is my situation. I'm working with an application for which uses hashing to authenticate data. I have a string, which is hashed. It is, like in a hash length extension attack, H(key:known_value) ...
user avatar
1 vote
1 answer
501 views

Can I compute “SHA256(secret||data)” when having “SHA256(secret)” and “data”?

I need to find the SHA256 hash of s string like this: part1-part2. I know the SHA256(part1), length of part1 and I know ...
user avatar
  • 113
2 votes
1 answer
132 views

How strong if I combine two hash functions, such as MD5(SHA256(input))?

If I try to do MD5(SHA256(input)), what is the strength of this so-called double hashing approach? Is it as strong as SHA256, or as strong as MD5, or as strong as ...
user avatar
1 vote
1 answer
160 views

Cycling hashing in PBKDF's and their limitations in strength?

I hope this question isn't too similar to one that's already been asked. I also want to point out I know part the answer already, AFAIK: I just want some expert input on this. Let's model a hash that ...
user avatar
  • 540