3 ms·
Presumably, if you're using the composition, it's hardened against the length-extension attack in the first place, right? I mean the advantage seems to only be
by gcp 9y ago
Presumably, if you're using the composition, it's hardened against the length-extension attack in the first place, right?
I mean the advantage seems to only be there when you're cobbling together your own constructions, i.e. doing what you shouldn't be doing.
- tptacek 9y agoLength extension attacks are idiosyncratic to hash functions with a particular underlying design (Merkle-Damgard compression). They are the reason we have HMAC. AEADs built on MACs that are not built on general-purpose hash functions don't have that problem.