Questions tagged [length-extension]
A length extension attack on a hash or message authentication code function, which allows extra information to be added to the input message without changing the output value.
63 questions
0
votes
0
answers
61
views
How the Baretto Naehrig rules for computing a sextic extension having the exact same order as the prime curve were computed?
For example, EIP197, I have $Y^2 = X^3 + 3$ having order $q$ equal to
21888242871839275222246405745257275088548364400416034343698204186575808495617
It’s the ...
- 339
4
votes
1
answer
184
views
Does the length extension attack apply to KDFs?
Older hash functions like SHA-256 and SHA-512 are vulnerable to the length extension attack, which is problematic in the context of a MAC. There are several ways to prevent this:
Use a newer hash ...
- 2,120
0
votes
1
answer
1k
views
Are RSA-SHA256 signatures prone to length extension attacks?
I need to sign a message using a private key and verify the message with a public key, while making sure the message hasn’t been tampered.
I know that SHA-256 itself is prone to length-extension ...
- 103
0
votes
1
answer
81
views
Would changing number of rounds in last compression prevent length extension attack?
Suppose we have some Merkle–Damgård hash function. Assuming compression function supports it and is equally secure with more rounds.
Would changing number of rounds (for example doubling them) for ...
- 1,702
-1
votes
1
answer
623
views
Can someone please explain the "secret" and the "data" in the MD5 hashing algorithm?
I've been studying the MD5 hashing algorithm, and there is something that I just don't understand yet. They say that the server holds some sort or "secret" and that it appends some sort of &...
- 13
2
votes
1
answer
165
views
Is the padding wrong on the "Length Extension Attack" Wikipedia page example?
In the Length extension attack of Wikipedia
The following information summarizes the relevant information provided on the page at the time of posting this question.
The provided parameters are
secret ...
- 123
2
votes
1
answer
347
views
How can Hashed Value be same in length extension attack?
Let's say we had the following information:
Secret = "Hello"
Message = "Attack at Dawn"
H(s,m) = ABC
Alice is sending a message to Bob but there is a person in the middle, ...
5
votes
2
answers
500
views
Encrypting messages without revealing length?
In various messengers, we have end-to-end encryption, making it hard to know what the message said.
But do these messengers have to pad the message to some maximum length every time, in order to hide ...
4
votes
3
answers
5k
views
Is it possible to fake any file's SHA-256 checksum with a length extension attack?
Can a fake SHA-256 checksum be created trivially for any file by attacker after padding some data after original file i.e. using length extension attack?
E.g:
Alice creates fake linux installation ...
- 41
1
vote
1
answer
844
views
is MAC double-hashing enough to prevent length extension attacks?
I know that
$$mac=\operatorname{SHA1}(secret\mathbin\|message)$$
is prone to length extension attacks, but what about:
$$mac=\operatorname{SHA1}(\operatorname{SHA1}(secret\mathbin\|message))?$$
In ...
- 569
4
votes
1
answer
968
views
Is Blake2b vulnerable to length extension attacks?
There are very few resources for Blake2b apart from the official documentation and website. I would like to know if Blake2b is not vulnerable to length extension attacks unlike SHA2. I would like your ...
- 341
4
votes
2
answers
1k
views
The length extension attack and security on length shortening of a hashed message by one byte
MD5, SHA1, SHA2 are vulnerable to length extension attacks Wikipedia:Length extension attack.
Could is also be possible to generate $H(\text{message}[1..n-1])$ from $H(\text{message}[1..n])$ if I know ...
- 151
2
votes
1
answer
72
views
HMAC for hash list
If I have a very large input to hash with a hash function vulnerable to length extention and I am using a hash list, should I HMAC each part of the input or just HMAC the final hash of all the hashes ?...
- 363
1
vote
1
answer
304
views
SHA256 hash malleability
Can an SHA-256 plaintext be malleable? For example:
Given $y = hash(x)$ , can an attacker find $z$ so that $z = hash(f(x))$. Here $f()$ might be the addition of a suffix to the message, an XOR ...
- 13
0
votes
1
answer
1k
views
Length extension attacks, Merkle–Damgård constructions, and HMACs
The wikipedia page for Length Extension Attacks says "Note that since HMAC doesn't use [Merkle–Damgård constructions], HMAC hashes are not prone to length extension attacks."
However, HMACs can be ...
- 127
2
votes
1
answer
3k
views
Length Extension attacks in SHA1 and MD5?
From my understanding on the internet about length-extension attack, I have understood that hash(secret_key|known_data) can be exploited to produce hash(secret_key|known_data|appended_data) even ...
- 43
0
votes
1
answer
140
views
Equal hashes for different messages when doing key length extension attack sha1
I was doing the cryptopals challenge 29, and I found something weird.
When I try to create a forged hash for a forged message I get always the same hash for different forged messages.
...
4
votes
1
answer
990
views
Is length extension attack considered as collision?
I came across a few articles about length extension attacks on cryptographic hash functions. I was very surprised to read that SHA-256 and SHA-512 are prone to length extension attacks. This seems ...
- 453
1
vote
0
answers
239
views
Secret key suffix vs HMAC [duplicate]
What is the benefit of using HMAC over hash with key suffix? I realize that using key prefix is a bad idea because it allows message extension attacks. When adding key as a suffix such attack ...
- 215
0
votes
1
answer
305
views
blake2b length extension attack approach
I understand that a completion flag parameter with Boolean value of 1 is used by Blake2 when it’s compressing the final block of the digested message.
This ensures that one cannot load the state of a ...
- 1,454
7
votes
2
answers
3k
views
If hash functions append the length, why does length extension attack work? [duplicate]
I have understood that it's trivial to reconstruct the internal state of a hasher for many hash functions, if one only knows the output hash. Then, one can append data after the original data and ...
- 1,623
2
votes
1
answer
1k
views
SHA1 padding on length extension attack
I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). ...
- 21
0
votes
1
answer
178
views
Is OpenSSL HMAC vulnerable to length extesion attacks when using MD5 as hash algorithm?
Given that a valid hash for a specific payload is known, would some C code like this be vulnerable to a length extension attack?
...
- 23
3
votes
2
answers
392
views
Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?
Have there ever been some publicized efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction (MD5, SHA1, SHA2, ...)?
- 6,511
3
votes
1
answer
221
views
Can length extension attacks be avoided by a single bit flip?
It always seemed to me that length extensions are possible simply because no special operation is performed after the last operation - for instance in a Merkle-Damgård construction. Basically the MD ...
- 94.5k
1
vote
0
answers
172
views
Backwards Length Extension Attack
Can SHA 256 be modified to make it vulnerable to length extension attack both by appending text to the front and adding text to the end?
- 121
2
votes
0
answers
753
views
Is it possible to prevent length extension attacks
Is it possible to prevent length extension attacks without using any other hash algorithm than SHA-1?
3
votes
0
answers
53
views
Is this a more effective HMAC? [duplicate]
I was given an argument in a conversation today and I don't know how to respond to it:
H( k || m || k ) should be a better choice of MAC than the traditional HMAC. The person's rationale was that: "...
- 31
1
vote
2
answers
364
views
Can `hash( messageA ) + messageB` be used to determine `hash( concat( messageA, messageB ) )`?
In .NET and other programming platforms all hash functions (such as MD5, SHA256, etc) can be used with streams of bytes, potentially forever - so it isn't necessary to read an entire multigigabyte ...
- 208
4
votes
1
answer
315
views
Understanding double hash and 0 block prepending to mitigate length extension attacks
So, reading the chapter about hash functions from the book "Applied Cryptography". There's a point where, as a conclusion, the construction:
SHA-X(SHA-X(0^b || m))
...
- 160
2
votes
1
answer
2k
views
Why is ECBC-MAC with one key insecure?
For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
- 3,705
3
votes
2
answers
332
views
4
votes
2
answers
1k
views
Is whirlpool vulnerable to length extension attack?
Is whirlpool vulnerable to length extension attacks?
I did not find anything on the topic and hardly anything interesting about whirlpool at all. I am trying to build some HMAC for a program and ...
- 4,495
1
vote
1
answer
4k
views
I didn't get the hash length extension attacks
I was trying to solve a cryptography challenge and the problem was about "hash length key extension". After some reading in different topics, I don't know why I still didn't solve the challenge.
I ...
- 111
4
votes
1
answer
836
views
Is CMAC vulnerable to length extension attacks?
Given $m_1, m_2$ such that $MAC_k(m_1) = MAC_k(m_2)$ is it possible to construct more collisions with pairs of the form $m_1|x, m_2|x$?
Here is the CMAC picture from Wikipedia where it is only part ...
- 4,933
1
vote
1
answer
1k
views
Length extension attack SHA-1 message division with padding problem?
I'm was reading this example for length extension attack given here
link
When working out, how the extended block length be divisible by 512 (SHA block size).
I'...
- 113
2
votes
0
answers
61
views
Is there a proof-of-work scheme vulnerable to length extension attack?
I wonder is there an example of proof of work scheme that uses a hash function and requires the hash function to be immune to length extension attack? I mean the scheme, that becomes easy to solve if ...
- 656
1
vote
1
answer
1k
views
How can I change the length of PRF output?
Say if I have a Pseudo Random Function PRF E: {0,1}^k x {0,1}^l -> {0,1}^l.
Hence it takes a key of length k and outputs ...
- 91
4
votes
1
answer
180
views
Is it possible to work out the hash using length extension attack but with different hashes type?
For example, I have:
Unknown: A secret variable, lets call it secret, that is unknown to me
Known: The length of secret, (lets ...
- 51
1
vote
1
answer
2k
views
Forge CBC-MAC by creating a new message, given the MAC of two messages
The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation
But I still cannot fully understand it, and here's my question:
given two messages ...
1
vote
1
answer
594
views
Can I compute “SHA256(secret||data)” when having “SHA256(secret)” and “data”?
I need to find the SHA256 hash of s string like this: part1-part2. I know the SHA256(part1), length of part1 and I know ...
- 113
2
votes
1
answer
1k
views
Do I need to use null bytes and \x80 in hash length extension attack?
Say I want to perform a hash length extension attack. All the tools I have used use \x00 and \x80 to pad hashes (hlextend and hashpump). But is it necessary to use these bytes? Based on my ...
- 121
3
votes
1
answer
713
views
What are fixed points and length extension attack in hash functions?
I was recently reading about hash functions, and I came across fixed points (one or more fixed points, interested in both) and length extensions, but I didn't exactly understand how these work. If ...
user4936
5
votes
1
answer
264
views
Does length-prepending stop length-extension attacks?
Does length-prepending stop length-extension attacks on Merkle-Damgård hash functions, assuming that the length is checked?
- 4,813
4
votes
1
answer
2k
views
How does the Flickr length extension attack work?
I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there.
...
- 307
2
votes
2
answers
1k
views
Keyless integrity checking with SHA-256
Currently a program is loading some files from an untrustworthy source (e.g. a CDN) which could have been tampered with. It has a known SHA-256 hash of the file stored locally, then it downloads the ...
- 21
12
votes
1
answer
589
views
Why isn't outputting only a portion of the hash state a simple defense against length extension attacks?
As I understand length extension attacks, they depend on the coincidental property of most cryptographic hash functions that the hash value is exactly the hash function state after hashing the last ...
- 223
2
votes
1
answer
2k
views
Hash length extension attack - SHA256 to 512 - impossible, correct?
Just want to be sure about something before I sign off on a method we're about to put into place.
We have a secret, to which a user-defined key is appended. The user can see the SHA256 hash of the ...
1
vote
1
answer
878
views
Solve a problem, thought it was hash length extension, hours later, am I wrong?
Here is my situation. I'm working with an application for which uses hashing to authenticate data.
I have a string, which is hashed. It is, like in a hash length extension attack, H(key:known_value)
...
0
votes
1
answer
2k
views
What is the exact purpose of length padding in Merkle–Damgård hash functions? [duplicate]
Is a length padding technique in a hash function used to avoid length extension attacks ?
- 2,897