4 ms·

i thought sha-2 included the message length in the head padding to prevent length extension attacks? just read the link you provided: it's sha-224 and above.

• tialaramex 4y ago
  I think you've badly misunderstood what's going on here. SHA-2 includes SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256. Six functions. Of these SHA-256 and SHA-512 are subject to the length extension attack (and SHA-224 only has 32-bit worth of safety which is clearly inadequate). Since you probably only needed a 256-bit hash, SHA-512/256 is a choice available today which produces a 256-bit hash without the possibility of length extension. Length extension works because the hash is the entire internal hash function state. This is not true for SHA-224, SHA-384, SHA-512/224 or SHA-512/256 since for these four functions not all of the internal state is exposed. No, the length is not included at the start of the data to be hashed, this would mean committing to entire input before we hash it, which is a pretty unsatisfactory API, the length is appended (with the padding).
  • a-dub 4y ago
    > I think you've badly misunderstood what's going on here. that sounds right. been almost a decade since i've dug into sha-2. i do remember the lengths in sha-256 and sha-512 though and i remember not being a huge fan of the chunking/padding code. come to think of it, there's another reason for the message length in the padding. i forget what it is now.