Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [length-extension]

A length extension attack on a hash or message authentication code function, which allows extra information to be added to the input message without changing the output value.

3
votes
1answer
75 views

Can length extension attacks be avoided by a single bit flip?

It always seemed to me that length extensions are possible simply because no special operation is performed after the last operation - for instance in a Merkle-Damgård construction. Basically the MD ...
1
vote
0answers
48 views

Backwards Length Extension Attack

Can SHA 256 be modified to make it vulnerable to length extension attack both by appending text to the front and adding text to the end?
2
votes
0answers
98 views

Is it possible to prevent length extension attacks

Is it possible to prevent length extension attacks without using any other hash algorithm than SHA-1?
3
votes
0answers
48 views

Is this a more effective HMAC? [duplicate]

I was given an argument in a conversation today and I don't know how to respond to it: H( k || m || k ) should be a better choice of MAC than the traditional HMAC. The person's rationale was that: "...
1
vote
2answers
59 views

Can `hash( messageA ) + messageB` be used to determine `hash( concat( messageA, messageB ) )`?

In .NET and other programming platforms all hash functions (such as MD5, SHA256, etc) can be used with streams of bytes, potentially forever - so it isn't necessary to read an entire multigigabyte ...
4
votes
1answer
59 views

Understanding double hash and 0 block prepending to mitigate length extension attacks

So, reading the chapter about hash functions from the book "Applied Cryptography". There's a point where, as a conclusion, the construction: SHA-X(SHA-X(0^b || m)) ...
1
vote
1answer
193 views

Why is ECBC-MAC with one key insecure?

For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
3
votes
2answers
182 views
3
votes
2answers
426 views

Is whirlpool vulnerable to length extension attack?

Is whirlpool vulnerable to length extension attacks? I did not find anything on the topic and hardly anything interesting about whirlpool at all. I am trying to build some HMAC for a program and ...
0
votes
1answer
816 views

I didn't get the hash length extension attacks

I was trying to solve a cryptography challenge and the problem was about "hash length key extension". After some reading in different topics, I don't know why I still didn't solve the challenge. I ...
0
votes
0answers
47 views

From block-wise Universal Hash Function to bit-wise UHF

Let's assume we have an $\epsilon$-bounded Universal Hash Function Family $H = \{H_K:\mathcal{X}^{\leq m}\rightarrow \mathcal{X}\mid \forall K\in \mathcal{K}\}$ with $\mathcal{X} = \mathcal{K} = \{0,1\...
4
votes
0answers
179 views

Is CMAC vulnerable to length extension attacks?

Given $m_1, m_2$ such that $MAC_k(m_1) = MAC_k(m_2)$ is it possible to construct more collisions with pairs of the form $m_1|x, m_2|x$? Here is the CMAC picture from Wikipedia where it is only part ...
1
vote
1answer
474 views

Length extension attack SHA-1 message division with padding problem?

I'm was reading this example for length extension attack given here link When working out, how the extended block length be divisible by 512 (SHA block size). I'...
2
votes
0answers
44 views

Is there a proof-of-work scheme vulnerable to length extension attack?

I wonder is there an example of proof of work scheme that uses a hash function and requires the hash function to be immune to length extension attack? I mean the scheme, that becomes easy to solve if ...
0
votes
1answer
300 views

How can I change the length of PRF output?

Say if I have a Pseudo Random Function PRF E: {0,1}^k x {0,1}^l -> {0,1}^l. Hence it takes a key of length k and outputs ...
4
votes
1answer
112 views

Is it possible to work out the hash using length extension attack but with different hashes type?

For example, I have: Unknown: A secret variable, lets call it secret, that is unknown to me Known: The length of secret, (lets ...
0
votes
0answers
269 views

PoC for hashpump (length extension attack on md5 mac)

I'm trying a PoC on a length extension attack using the tool hashpump. apparently I'm doing something wrong because no matter what I do I don't get matching hashes from the legitimate calculation (...
0
votes
1answer
456 views

Forge CBC-MAC by creating new message, giving the MAC of two messages

The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation But i still cannot fully understand it, and here's my question: giving two messages ...
1
vote
1answer
199 views

Can I compute “SHA256(secret||data)” when having “SHA256(secret)” and “data”?

I need to find the SHA256 hash of s string like this: part1-part2. I know the SHA256(part1), length of part1 and I know ...
2
votes
1answer
390 views

Do I need to use null bytes and \x80 in hash length extension attack?

Say I want to perform a hash length extension attack. All the tools I have used use \x00 and \x80 to pad hashes (hlextend and hashpump). But is it necessary to use these bytes? Based on my ...
3
votes
1answer
273 views

What are fixed points and length extension attack in hash functions?

I was recently reading about hash functions, and I came across fixed points (one or more fixed points, interested in both) and length extensions, but I didn't exactly understand how these work. If ...
5
votes
1answer
152 views

Does length-prepending stop length-extension attacks?

Does length-prepending stop length-extension attacks on Merkle-Damgård hash functions, assuming that the length is checked?
4
votes
1answer
692 views

How does the Flickr length extension attack work?

I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there. ...
2
votes
2answers
635 views

Keyless integrity checking with SHA-256

Currently a program is loading some files from an untrustworthy source (e.g. a CDN) which could have been tampered with. It has a known SHA-256 hash of the file stored locally, then it downloads the ...
12
votes
1answer
462 views

Why isn't outputting only a portion of the hash state a simple defense against length extension attacks?

As I understand length extension attacks, they depend on the coincidental property of most cryptographic hash functions that the hash value is exactly the hash function state after hashing the last ...
2
votes
1answer
820 views

Hash length extension attack - SHA256 to 512 - impossible, correct?

Just want to be sure about something before I sign off on a method we're about to put into place. We have a secret, to which a user-defined key is appended. The user can see the SHA256 hash of the ...
1
vote
1answer
363 views

Solve a problem, thought it was hash length extension, hours later, am I wrong?

Here is my situation. I'm working with an application for which uses hashing to authenticate data. I have a string, which is hashed. It is, like in a hash length extension attack, H(key:known_value) ...
0
votes
1answer
1k views

What is the exact purpose of length padding in Merkle–Damgård hash functions? [duplicate]

Is a length padding technique in a hash function used to avoid length extension attacks ?
3
votes
1answer
1k views

CBC-MAC length extension attack with IV simulation

I'm doing the Cryptopals challenges (formerly the Matasano challenges) and struggling with second part of the 49th problem where I'm asked to do the length extension attack with CBC-MAC without IV ...
2
votes
1answer
126 views

Is concatenated data hashed with scrypt vulunarable to a length extension attack?

scrypt takes a salt, and a password plus some cost paramters to generate a key. So say we define it as this: key = scrypt(password, salt, cost) I am interested ...
8
votes
1answer
5k views

How does the secret key in an HMAC prevent modification of the HMAC?

Just as a preface: I'm not implementing a HMAC - I just want to understand it, as it is part of of my Computer Science course. When using Hash-based message authentication codes, I understand that ...
0
votes
0answers
128 views

Why is Merkle-Damgård construction insecure? [duplicate]

I've been reading about SHA-1. I read that SHA-1 is insecure as it uses the Merkle-Damgård construction and the Merkle-Damgård construction is — according to Wikipedia — susceptible to a variety of ...
2
votes
0answers
210 views

Is it possible to derive the midstate of a sha256 hash?

Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc". (In PHP: <...
7
votes
1answer
2k views

Why is H(message||secret_key) not vulnerable to length-extension attack?

Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$. Why can't he perform the same ...
3
votes
1answer
852 views

length extension attack on an MD5 hash of a text file of about 10K Bytes?

How much computing time on a typical desktop computer would it take to find a new length and new data to extend a text file of about 10K Bytes with a given MD5 hash?
2
votes
0answers
48 views

Will length-extension work if secret is not prefixed but appended to the data? [duplicate]

Possible Duplicate: Why is h(m||k) insecure? Length-extension allows to append any data to the message while not knowing the secret. Any length-extension explaination one the web considers the ...
32
votes
2answers
19k views

Understanding the length extension attack

I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully ...
5
votes
1answer
449 views

md5: is reverse length-extension attack possible?

If I know H = md5( SECRET_KEY | DATA ) then I can calculate H' = md5( SECRET_KEY | DATA | DATA' ) That's length-extension ...
28
votes
3answers
3k views

Purpose of outer key in HMAC

From what I know, the HMAC constructions has two strength: It's resistant to length extensions Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
14
votes
1answer
2k views

In which situations is a length-extension attack a problem?

A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem? I guess certain naive ...
4
votes
2answers
252 views

Is a random length-extension worth the effort?

I'm conceiving an application that uses cryptographic tools and concepts for securing data. I know that's difficult and risky, therefore I prefer to ask around before implementing anything. When ...