18
votes
Accepted
If hash functions append the length, why does length extension attack work?
Let hash be the raw hash function, as you're referring to. You mentioned that the attacker knows hash(message || length), but to ...
- 6,404
9
votes
Is it possible to fake any file's SHA-256 checksum with a length extension attack?
Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO ...
- 145k
7
votes
Accepted
What are fixed points and length extension attack in hash functions?
If $H(x) = x$, $x$ is a fixed point. If for a value the output of the function is the same as the input, it is called a fixed point.
A length extension attack is unrelated to the concept of fixed ...
- 19.5k
7
votes
Accepted
Is length extension attack considered as collision?
No, the length extension attack/property is not considered a collision. It does not allow to build a collision.
The length extension property is that given the hash of a bitstring $M$ of given length ...
- 138k
6
votes
Accepted
Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?
Yes. In this paper, Coron and al. showed that a plain MD construction is secure when it's inputs are prefix-free. They actually proved the indifferentiability of the construction. In other words ...
- 2,868
6
votes
Understanding double hash and 0 block prepending to mitigate length extension attacks
The objective of the construction $H'(m)=H(H(0^b\mathbin\|m))$ is not to strengthen $H$ against collision attacks; as noted in the question, that does not work.
The objective is preventing a length-...
- 138k
6
votes
Accepted
The length extension attack and security on length shortening of a hashed message by one byte
Could is also be possible to generate $H(\text{message}[1..n-1])$ from $H(\text{message}[1..n])$ if I know the last byte?
No, the length extension attacks are not working exactly like that. Let see ...
- 47.6k
5
votes
Accepted
blake2b length extension attack approach
BLAKE2 is not open-source. BLAKE2 is a specification.
The state is shuffled one last time after having set the final bit, ensuring that a small change, even a single bit, yields a completely ...
- 2,924
5
votes
Accepted
Does length-prepending stop length-extension attacks?
Yes, if the length is formatted in a constant-size value (e.g. 64-bit field) or in an otherwise uniquely decodable manner.
With such a length field, no hash input can be the the prefix of another ...
- 32k
5
votes
Keyless integrity checking with SHA-256
A length extension attack doesn't let you find a collision. It lets you predict the hash for an input with an unknown component in the prefix. If you have $h = H(x)$ for unknown (or partially unknown) ...
- 11k
5
votes
Accepted
Is whirlpool vulnerable to length extension attack?
Let's split your question into two parts: first the length extension attack problem with Whirlpool, and next your HMAC tool idea.
1. Is whirlpool vulnerable to length extension attack?
Yes, ...
- 17.8k
5
votes
Accepted
Is it possible to work out the hash using length extension attack but with different hashes type?
This is not possible in general, or for the specific case of SHA1 and SHA512. Length extension works because MD-hashes iterate the same function, so knowing the output you also know the intermediate ...
- 32k
5
votes
Length Extension attacks in SHA1 and MD5?
You forget one little step of how Merkle–Damgård construction works; the padding, here SHA-1 padding:
append the bit $\texttt{1}$ to the message e.g. by adding $\texttt{0x80}$ if message length (ml) ...
- 47.6k
5
votes
Accepted
Are RSA-SHA256 signatures prone to length extension attacks?
But what if I sign a message with RSA and SHA-256? Are they safe?
Length extension attacks are not a concern.
Here is what a length extension attack allows you do to: if you are given the hash $\text{...
- 145k
4
votes
How can I change the length of PRF output?
I don't understand why you are talking about a 1-1 property; a pseudorandom function is not 1-1. As such, you can always just truncate in order to reduce the output size, and you can just truncate by ...
- 27.6k
4
votes
Accepted
Is Blake2b vulnerable to length extension attacks?
All from the BLAKE2 paper BLAKE2: simpler, smaller, fast as MD5
First of all
BLAKE2b is optimized for 64-bit platforms — including NEON-enabled
ARMs — and produces digests of any size between 1 and ...
- 47.6k
4
votes
Accepted
is MAC double-hashing enough to prevent length extension attacks?
$$mac=\operatorname{SHA1}(\operatorname{SHA1}(secret\mathbin\|message))$$
is mac double-hashing enough to prevent length extension attacks?
Double hashing is defined by Ferguson and Schneier in ...
- 47.6k
3
votes
Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?
Fixed output filters like SHA-256d
Keyed output filters like HMAC, envelope-MAC, etc.
Truncation like SHA-512/256
Prefix-free message encoding like length-prefixed
Non-MD designs like BLAKE2 with ...
- 47.9k
3
votes
If hash functions append the length, why does length extension attack work?
You should think of the attack as being directed against the hash function as a whole. What you are calling
$$\mathrm{hash}(\mbox{message} + \mbox{length})$$
is really
$$\mathrm{Hash}(\mbox{message}...
- 151
3
votes
Can `hash( messageA ) + messageB` be used to determine `hash( concat( messageA, messageB ) )`?
With a little more information, an attacker can indeed get up to some funny business by abusing this "internal state-revealing" property of Merkle-Damgard style hash functions (this includes MD5 and ...
- 31
3
votes
Accepted
Length extension attack SHA-1 message division with padding problem?
OK, lets go through this step by step:
the message size of http://example.com/downloadfile=report.pdf is 10 bytes, as only the filename (...
- 91.9k
3
votes
Accepted
GOST R 34.11-2012 hash function works from the end, is this convenient in practice?
Actually, GOST R 34.11-2012 hash function doesn't work from the end. It defines M as a binary vector to be hashed. The binary number is usually printed with the least significant bit printed last. ...
- 165
3
votes
GOST R 34.11-2012 hash function works from the end, is this convenient in practice?
I understand, that this approach is more secure and eliminate length extension attack
Actually, just be processing the blocks backwards doesn't actually eliminate any attacks. Instead of 'length ...
- 145k
3
votes
Do I need to use null bytes and \x80 in hash length extension attack?
But is it necessary to use these bytes?
Yes, it is, at least for most messages that you'll see in practice. MD5 works by taking the message, and applying a fixed padding to it. This fixed padding ...
- 145k
3
votes
The length extension attack and security on length shortening of a hashed message by one byte
No, currently not even MD5 is broken enough for this.
MD5 and SHA-1/2 all use a simple Merkle-Damgard construction. In an MD construction basically what you get is (for a message split into two ...
- 91.9k
3
votes
Encrypting messages without revealing length?
This is a complementary answer to the Model Nest's answer, and will concentrate on how to achieve the constant size for messages. We assume that the files have confidentiality, integrity, and ...
- 47.6k
2
votes
Accepted
How does the Flickr length extension attack work?
How can he do that? He could take api_signature = h = md5(m) and use it as the Initialization Vector of the hash function and hash the extra data and another ...
- 32k
2
votes
Keyless integrity checking with SHA-256
This answers a comment to Stephen Touset's fine answer.
With SHA-256, or any collision-resistant hash, no known attack (including length extension) allows producing a file different from the original ...
- 138k
2
votes
In which situations is a length-extension attack a problem?
Another affected use is in commitments where a hash function is meant to perfectly hide some information until time comes to reveal it. A function susceptible to length-extension would allow an ...
- 133
2
votes
I didn't get the hash length extension attacks
OK, so the general idea of MD5 and SHA-1 and SHA-2 is that they process the data in blocks. For the last block the algorithms first append a padding to the plaintext data and the encoding of the ...
- 91.9k
Only top scored, non community-wiki answers of a minimum length are eligible