# Tag Info

Accepted

### If hash functions append the length, why does length extension attack work?

Let hash be the raw hash function, as you're referring to. You mentioned that the attacker knows hash(message || length), but to ...

### Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Using $H(m\mathbin\Vert k)$ with hash function $H$, message $m$ and key $k$, is one possible way to build a MAC algorithm. It is not necessarily a good one; it depends on the used hash function. Even ...

### Is it accurate to say that SHA-3 (keccak) is based on Merkle-Damgård?

No. That is about as accurate as saying that airplanes are based on motorcycles, because they both have engines. In MD, the input to the hash is converted to a key, which is used by a block cipher to ...

### What happens if a SHA-256 input is too long (longer than 512 bits)?

If the input message is longer than 512 bits, the input is chopped in “chunks” (read: pieces) with fitting length (512 bits) and those are successively fed to the hash compression function. See, in ...
Accepted

### Forgery attack for Merkle–Damgård MAC scheme with prefix method

A lot of this is explained well on the wikipedia article. The function $f$ is called the compression function. It is a function f:\left\{0,1\right\}^n\times\left\{0,1\right\}^\ell\to\left\{0,1\...
Accepted

### Would finding a Merkle-Damgård preimage that doesn't change the initial state allow an attacker to prepend it to any hashed message?

Not quite. But it would allow computing ${\rm MD5}(M \,\|\, {\rm pad}_M \,\|\, m \,\|\, {\rm pad}_m \,\|\, {\rm whatever})$, where ${\rm pad}_M$ and ${\rm pad}_m$ are the extra length padding bytes ...