# Tag Info

Accepted

### If hash functions append the length, why does length extension attack work?

Let hash be the raw hash function, as you're referring to. You mentioned that the attacker knows hash(message || length), but to ...
• 6,189
Accepted

### Why isn't outputting only a portion of the hash state a simple defense against length extension attacks?

Contrary to your assumption, this is done, and it is secure: For instance, the hash functions SHA-224 and SHA-384 are basically the same algorithms as SHA-256 and SHA-512! The only differences are in ...
• 11.3k

### Is it possible to fake any file's SHA-256 checksum with a length extension attack?

Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO ...
• 136k
Accepted

### What are fixed points and length extension attack in hash functions?

If $H(x) = x$, $x$ is a fixed point. If for a value the output of the function is the same as the input, it is called a fixed point. A length extension attack is unrelated to the concept of fixed ...
• 19.3k
Accepted

### Is length extension attack considered as collision?

No, the length extension attack/property is not considered a collision. It does not allow to build a collision. The length extension property is that given the hash of a bitstring $M$ of given length ...
• 128k

### Understanding double hash and 0 block prepending to mitigate length extension attacks

The objective of the construction $H'(m)=H(H(0^b\mathbin\|m))$ is not to strengthen $H$ against collision attacks; as noted in the question, that does not work. The objective is preventing a length-...
• 128k
Accepted

### Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?

Yes. In this paper, Coron and al. showed that a plain MD construction is secure when it's inputs are prefix-free. They actually proved the indifferentiability of the construction. In other words ...
• 1,844
Accepted

### The length extension attack and security on length shortening of a hashed message by one byte

Could is also be possible to generate $H(\text{message}[1..n-1])$ from $H(\text{message}[1..n])$ if I know the last byte? No, the length extension attacks are not working exactly like that. Let see ...
• 45.2k
Accepted

### Does length-prepending stop length-extension attacks?

Yes, if the length is formatted in a constant-size value (e.g. 64-bit field) or in an otherwise uniquely decodable manner. With such a length field, no hash input can be the the prefix of another ...
• 31.5k
Accepted

### Is it possible to work out the hash using length extension attack but with different hashes type?

This is not possible in general, or for the specific case of SHA1 and SHA512. Length extension works because MD-hashes iterate the same function, so knowing the output you also know the intermediate ...
• 31.5k

### Keyless integrity checking with SHA-256

A length extension attack doesn't let you find a collision. It lets you predict the hash for an input with an unknown component in the prefix. If you have $h = H(x)$ for unknown (or partially unknown) ...
• 10.7k
Accepted

### Is whirlpool vulnerable to length extension attack?

Let's split your question into two parts: first the length extension attack problem with Whirlpool, and next your HMAC tool idea. 1. Is whirlpool vulnerable to length extension attack? Yes, ...
• 17.5k
Accepted

### blake2b length extension attack approach

BLAKE2 is not open-source. BLAKE2 is a specification. The state is shuffled one last time after having set the final bit, ensuring that a small change, even a single bit, yields a completely ...
• 2,847
Accepted

• 45.2k

### The length extension attack and security on length shortening of a hashed message by one byte

No, currently not even MD5 is broken enough for this. MD5 and SHA-1/2 all use a simple Merkle-Damgard construction. In an MD construction basically what you get is (for a message split into two ...
• 87.1k

### Encrypting messages without revealing length?

This is a complementary answer to the Model Nest's answer, and will concentrate on how to achieve the constant size for messages. We assume that the files have confidentiality, integrity, and ...
• 45.2k
Accepted

### How does the Flickr length extension attack work?

How can he do that? He could take api_signature = h = md5(m) and use it as the Initialization Vector of the hash function and hash the extra data and another ...
• 31.5k