18 votes
Accepted

If hash functions append the length, why does length extension attack work?

Let hash be the raw hash function, as you're referring to. You mentioned that the attacker knows hash(message || length), but to ...
  • 6,139
13 votes
Accepted

Why isn't outputting only a portion of the hash state a simple defense against length extension attacks?

Contrary to your assumption, this is done, and it is secure: For instance, the hash functions SHA-224 and SHA-384 are basically the same algorithms as SHA-256 and SHA-512! The only differences are in ...
  • 11.2k
9 votes

Is it possible to fake any file's SHA-256 checksum with a length extension attack?

Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO ...
  • 135k
7 votes
Accepted

What are fixed points and length extension attack in hash functions?

If $H(x) = x$, $x$ is a fixed point. If for a value the output of the function is the same as the input, it is called a fixed point. A length extension attack is unrelated to the concept of fixed ...
  • 19.3k
7 votes
Accepted

Is length extension attack considered as collision?

No, the length extension attack/property is not considered a collision. It does not allow to build a collision. The length extension property is that given the hash of a bitstring $M$ of given length ...
  • 126k
6 votes

Understanding double hash and 0 block prepending to mitigate length extension attacks

The objective of the construction $H'(m)=H(H(0^b\mathbin\|m))$ is not to strengthen $H$ against collision attacks; as noted in the question, that does not work. The objective is preventing a length-...
  • 126k
6 votes
Accepted

Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?

Yes. In this paper, Coron and al. showed that a plain MD construction is secure when it's inputs are prefix-free. They actually proved the indifferentiability of the construction. In other words ...
  • 1,422
6 votes
Accepted

The length extension attack and security on length shortening of a hashed message by one byte

Could is also be possible to generate $H(\text{message}[1..n-1])$ from $H(\text{message}[1..n])$ if I know the last byte? No, the length extension attacks are not working exactly like that. Let see ...
  • 44.3k
5 votes
Accepted

Does length-prepending stop length-extension attacks?

Yes, if the length is formatted in a constant-size value (e.g. 64-bit field) or in an otherwise uniquely decodable manner. With such a length field, no hash input can be the the prefix of another ...
  • 31.5k
5 votes
Accepted

Is whirlpool vulnerable to length extension attack?

Let's split your question into two parts: first the length extension attack problem with Whirlpool, and next your HMAC tool idea. 1. Is whirlpool vulnerable to length extension attack? Yes, ...
  • 17.5k
5 votes
Accepted

Is it possible to work out the hash using length extension attack but with different hashes type?

This is not possible in general, or for the specific case of SHA1 and SHA512. Length extension works because MD-hashes iterate the same function, so knowing the output you also know the intermediate ...
  • 31.5k
5 votes

Keyless integrity checking with SHA-256

A length extension attack doesn't let you find a collision. It lets you predict the hash for an input with an unknown component in the prefix. If you have $h = H(x)$ for unknown (or partially unknown) ...
5 votes
Accepted

blake2b length extension attack approach

BLAKE2 is not open-source. BLAKE2 is a specification. The state is shuffled one last time after having set the final bit, ensuring that a small change, even a single bit, yields a completely ...
  • 2,849
5 votes
Accepted

Are RSA-SHA256 signatures prone to length extension attacks?

But what if I sign a message with RSA and SHA-256? Are they safe? Length extension attacks are not a concern. Here is what a length extension attack allows you do to: if you are given the hash $\text{...
  • 135k
4 votes
Accepted

Is Blake2b vulnerable to length extension attacks?

All from the BLAKE2 paper BLAKE2: simpler, smaller, fast as MD5 First of all BLAKE2b is optimized for 64-bit platforms — including NEON-enabled ARMs — and produces digests of any size between 1 and ...
  • 44.3k
4 votes
Accepted

is MAC double-hashing enough to prevent length extension attacks?

$$mac=\operatorname{SHA1}(\operatorname{SHA1}(secret\mathbin\|message))$$ is mac double-hashing enough to prevent length extension attacks? Double hashing is defined by Ferguson and Schneier in ...
  • 44.3k
3 votes

If hash functions append the length, why does length extension attack work?

You should think of the attack as being directed against the hash function as a whole. What you are calling $$\mathrm{hash}(\mbox{message} + \mbox{length})$$ is really $$\mathrm{Hash}(\mbox{message}...
3 votes

Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?

Fixed output filters like SHA-256d Keyed output filters like HMAC, envelope-MAC, etc. Truncation like SHA-512/256 Prefix-free message encoding like length-prefixed Non-MD designs like BLAKE2 with ...
3 votes

Can `hash( messageA ) + messageB` be used to determine `hash( concat( messageA, messageB ) )`?

With a little more information, an attacker can indeed get up to some funny business by abusing this "internal state-revealing" property of Merkle-Damgard style hash functions (this includes MD5 and ...
3 votes
Accepted

GOST R 34.11-2012 hash function works from the end, is this convenient in practice?

Actually, GOST R 34.11-2012 hash function doesn't work from the end. It defines M as a binary vector to be hashed. The binary number is usually printed with the least significant bit printed last. ...
  • 165
3 votes

GOST R 34.11-2012 hash function works from the end, is this convenient in practice?

I understand, that this approach is more secure and eliminate length extension attack Actually, just be processing the blocks backwards doesn't actually eliminate any attacks. Instead of 'length ...
  • 135k
3 votes

Do I need to use null bytes and \x80 in hash length extension attack?

But is it necessary to use these bytes? Yes, it is, at least for most messages that you'll see in practice. MD5 works by taking the message, and applying a fixed padding to it. This fixed padding ...
  • 135k
3 votes
Accepted

Length extension attack SHA-1 message division with padding problem?

OK, lets go through this step by step: the message size of http://example.com/downloadfile=report.pdf is 10 bytes, as only the filename (...
  • 86.6k
3 votes

How can I change the length of PRF output?

I don't understand why you are talking about a 1-1 property; a pseudorandom function is not 1-1. As such, you can always just truncate in order to reduce the output size, and you can just truncate by ...
3 votes
Accepted

Hash length extension attack - SHA256 to 512 - impossible, correct?

No, there is no known way. It would actually be rather surprising if there were even a theoretical way; the SHA-256 and the SHA-512 compression functions are rather different (for one, one works with ...
  • 135k
3 votes

Length Extension attacks in SHA1 and MD5?

You forget one little step of how Merkle–Damgård construction works; the padding, here SHA-1 padding: append the bit $\texttt{1}$ to the message e.g. by adding $\texttt{0x80}$ if message length is ...
  • 44.3k
3 votes

The length extension attack and security on length shortening of a hashed message by one byte

No, currently not even MD5 is broken enough for this. MD5 and SHA-1/2 all use a simple Merkle-Damgard construction. In an MD construction basically what you get is (for a message split into two ...
  • 86.6k
3 votes

Encrypting messages without revealing length?

This is a complementary answer to the Model Nest's answer, and will concentrate on how to achieve the constant size for messages. We assume that the files have confidentiality, integrity, and ...
  • 44.3k
2 votes
Accepted

How does the Flickr length extension attack work?

How can he do that? He could take api_signature = h = md5(m) and use it as the Initialization Vector of the hash function and hash the extra data and another ...
  • 31.5k
2 votes

Keyless integrity checking with SHA-256

This answers a comment to Stephen Touset's fine answer. With SHA-256, or any collision-resistant hash, no known attack (including length extension) allows producing a file different from the original ...
  • 126k

Only top scored, non community-wiki answers of a minimum length are eligible