Skip to main content
18 votes
Accepted

If hash functions append the length, why does length extension attack work?

Let hash be the raw hash function, as you're referring to. You mentioned that the attacker knows hash(message || length), but to ...
Conrado's user avatar
  • 6,484
9 votes

Is it possible to fake any file's SHA-256 checksum with a length extension attack?

Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO ...
poncho's user avatar
  • 148k
7 votes
Accepted

Is length extension attack considered as collision?

No, the length extension attack/property is not considered a collision. It does not allow to build a collision. The length extension property is that given the hash of a bitstring $M$ of given length ...
fgrieu's user avatar
  • 142k
7 votes
Accepted

What are fixed points and length extension attack in hash functions?

If $H(x) = x$, $x$ is a fixed point. If for a value the output of the function is the same as the input, it is called a fixed point. A length extension attack is unrelated to the concept of fixed ...
Ella Rose's user avatar
  • 19.7k
6 votes

Understanding double hash and 0 block prepending to mitigate length extension attacks

The objective of the construction $H'(m)=H(H(0^b\mathbin\|m))$ is not to strengthen $H$ against collision attacks; as noted in the question, that does not work. The objective is preventing a length-...
fgrieu's user avatar
  • 142k
6 votes
Accepted

Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?

Yes. In this paper, Coron and al. showed that a plain MD construction is secure when it's inputs are prefix-free. They actually proved the indifferentiability of the construction. In other words ...
Marc Ilunga's user avatar
  • 3,338
6 votes
Accepted

The length extension attack and security on length shortening of a hashed message by one byte

Could is also be possible to generate $H(\text{message}[1..n-1])$ from $H(\text{message}[1..n])$ if I know the last byte? No, the length extension attacks are not working exactly like that. Let see ...
kelalaka's user avatar
  • 49k
5 votes

Length Extension attacks in SHA1 and MD5?

You forget one little step of how Merkle–Damgård construction works; the padding, here SHA-1 padding: append the bit $\texttt{1}$ to the message e.g. by adding $\texttt{0x80}$ if message length (ml) ...
kelalaka's user avatar
  • 49k
5 votes
Accepted

blake2b length extension attack approach

BLAKE2 is not open-source. BLAKE2 is a specification. The state is shuffled one last time after having set the final bit, ensuring that a small change, even a single bit, yields a completely ...
Frank Denis's user avatar
  • 2,973
5 votes
Accepted

Is whirlpool vulnerable to length extension attack?

Let's split your question into two parts: first the length extension attack problem with Whirlpool, and next your HMAC tool idea. 1. Is whirlpool vulnerable to length extension attack? Yes, ...
e-sushi's user avatar
  • 18k
5 votes
Accepted

Is it possible to work out the hash using length extension attack but with different hashes type?

This is not possible in general, or for the specific case of SHA1 and SHA512. Length extension works because MD-hashes iterate the same function, so knowing the output you also know the intermediate ...
otus's user avatar
  • 32.2k
5 votes
Accepted

is MAC double-hashing enough to prevent length extension attacks?

$$mac=\operatorname{SHA1}(\operatorname{SHA1}(secret\mathbin\|message))$$ is mac double-hashing enough to prevent length extension attacks? Double hashing is defined by Ferguson and Schneier in ...
kelalaka's user avatar
  • 49k
5 votes
Accepted

Are RSA-SHA256 signatures prone to length extension attacks?

But what if I sign a message with RSA and SHA-256? Are they safe? Length extension attacks are not a concern. Here is what a length extension attack allows you do to: if you are given the hash $\text{...
poncho's user avatar
  • 148k
4 votes

How can I change the length of PRF output?

I don't understand why you are talking about a 1-1 property; a pseudorandom function is not 1-1. As such, you can always just truncate in order to reduce the output size, and you can just truncate by ...
Yehuda Lindell's user avatar
4 votes
Accepted

Is Blake2b vulnerable to length extension attacks?

All from the BLAKE2 paper BLAKE2: simpler, smaller, fast as MD5 First of all BLAKE2b is optimized for 64-bit platforms — including NEON-enabled ARMs — and produces digests of any size between 1 and ...
kelalaka's user avatar
  • 49k
3 votes

If hash functions append the length, why does length extension attack work?

You should think of the attack as being directed against the hash function as a whole. What you are calling $$\mathrm{hash}(\mbox{message} + \mbox{length})$$ is really $$\mathrm{Hash}(\mbox{message}...
The_Sympathizer's user avatar
3 votes

Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?

Fixed output filters like SHA-256d Keyed output filters like HMAC, envelope-MAC, etc. Truncation like SHA-512/256 Prefix-free message encoding like length-prefixed Non-MD designs like BLAKE2 with ...
Squeamish Ossifrage's user avatar
3 votes
Accepted

GOST R 34.11-2012 hash function works from the end, is this convenient in practice?

Actually, GOST R 34.11-2012 hash function doesn't work from the end. It defines M as a binary vector to be hashed. The binary number is usually printed with the least significant bit printed last. ...
kerukuro's user avatar
  • 165
3 votes

GOST R 34.11-2012 hash function works from the end, is this convenient in practice?

I understand, that this approach is more secure and eliminate length extension attack Actually, just be processing the blocks backwards doesn't actually eliminate any attacks. Instead of 'length ...
poncho's user avatar
  • 148k
3 votes

Can `hash( messageA ) + messageB` be used to determine `hash( concat( messageA, messageB ) )`?

With a little more information, an attacker can indeed get up to some funny business by abusing this "internal state-revealing" property of Merkle-Damgard style hash functions (this includes MD5 and ...
Kiran Chana's user avatar
3 votes
Accepted

Length extension attack SHA-1 message division with padding problem?

OK, lets go through this step by step: the message size of http://example.com/downloadfile=report.pdf is 10 bytes, as only the filename (...
Maarten Bodewes's user avatar
  • 93.2k
3 votes

Do I need to use null bytes and \x80 in hash length extension attack?

But is it necessary to use these bytes? Yes, it is, at least for most messages that you'll see in practice. MD5 works by taking the message, and applying a fixed padding to it. This fixed padding ...
poncho's user avatar
  • 148k
3 votes

The length extension attack and security on length shortening of a hashed message by one byte

No, currently not even MD5 is broken enough for this. MD5 and SHA-1/2 all use a simple Merkle-Damgard construction. In an MD construction basically what you get is (for a message split into two ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes

Encrypting messages without revealing length?

This is a complementary answer to the Model Nest's answer, and will concentrate on how to achieve the constant size for messages. We assume that the files have confidentiality, integrity, and ...
kelalaka's user avatar
  • 49k
2 votes

In which situations is a length-extension attack a problem?

Another affected use is in commitments where a hash function is meant to perfectly hide some information until time comes to reveal it. A function susceptible to length-extension would allow an ...
bca-0353f40e's user avatar
2 votes

Can `hash( messageA ) + messageB` be used to determine `hash( concat( messageA, messageB ) )`?

First, this is not generally true of SHA-256 or MD5. What is true is that $$\operatorname{SHA256}(\operatorname{pad}(m) \mathbin\Vert m') = f(\operatorname{SHA256}(m), m')$$ for some easily computed ...
Squeamish Ossifrage's user avatar
2 votes

Why is ECBC-MAC with one key insecure?

Note that re-encrypting the output of CBC-MAC with the same key as it was calculated with is equivalent to appending a single all-zero cipher block to the message: $$E_K(\text{CBC-MAC}_K(m)) = E_K(\...
Ilmari Karonen's user avatar
2 votes

I didn't get the hash length extension attacks

OK, so the general idea of MD5 and SHA-1 and SHA-2 is that they process the data in blocks. For the last block the algorithms first append a padding to the plaintext data and the encoding of the ...
Maarten Bodewes's user avatar
  • 93.2k
2 votes
Accepted

Length extension attacks, Merkle–Damgård constructions, and HMACs

Your quote is wrong: The wikipedia page for Length Extension Attacks says "Note that since HMAC doesn't use [Merkle–Damgård constructions], HMAC hashes are not prone to length extension attacks." ...
Luis Casillas's user avatar
2 votes
Accepted

HMAC for hash list

You can just use a hash tree with a pre-configured node size then only the last hash value would be vulnerable to a length extension attack. In that sense this is not that different from performing a ...
Maarten Bodewes's user avatar
  • 93.2k

Only top scored, non community-wiki answers of a minimum length are eligible