4 ms·

> What's wrong with this? There's the same information at that point. You only have another permutation function. Once the internal state is "sufficiently mixed

by schoen 5y ago

> What's wrong with this? There's the same information at that point. You only have another permutation function. Once the internal state is "sufficiently mixed up" (that is... in the 2-bit case... the 2-bits of input can become 2-bits of output in a sufficiently mixed up way), you can't get any better than just returning the input state. I'm sure the original poster is referring to https://en.wikipedia.org/wiki/Length_extension_attack https://en.wikipedia.org/wiki/Length_extension_attack It seems like the general solution in the SHA family has been to return a subset of the internal state ("truncation"). This then creates unknown state that an attacker would have to guess in order to perform a length extension. https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functions https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functi... Edit: Indeed, the original article turns out to teach you to implement the length extension attack at the end, and states that it "was a design mistake" in SHA-256 not to truncate.

dragontamer 5y ago
Fair enough. But that argument is a bit subtle. Going back to the 2 bit input example, if your internal state is 4 bits, you only have 2 bits of entropy. So outputting the first two bits of your 4 but state is still (probably) valid as far as a hash is concerned, assuming a good enough mixing function. But at the same time, if you need all 4 bits to adequately continue the hash, then 'hiding' those other two bits will help out. So it's not so much the truncation, as much as it is the unnecessary expansion and then later truncation steps that's useful for hashing. (Ex: SHA512 truncated to 256 bits is immune to the attack described). In any case, these attacks are ad-hoc and don't seem to have any pattern. Crypto-experts design against attacks like these. Since there is no pattern, you end up having to study all these attacks and designing against all of them.

by schoen 5y ago

dragontamer 5y ago

Fair enough. But that argument is a bit subtle. Going back to the 2 bit input example, if your internal state is 4 bits, you only have 2 bits of entropy. So outputting the first two bits of your 4 but state is still (probably) valid as far as a hash is concerned, assuming a good enough mixing function. But at the same time, if you need all 4 bits to adequately continue the hash, then 'hiding' those other two bits will help out. So it's not so much the truncation, as much as it is the unnecessary expansion and then later truncation steps that's useful for hashing. (Ex: SHA512 truncated to 256 bits is immune to the attack described). In any case, these attacks are ad-hoc and don't seem to have any pattern. Crypto-experts design against attacks like these. Since there is no pattern, you end up having to study all these attacks and designing against all of them.