5 ms·
> Here’s the deal: if I tell you that SHA1(foo) is X, then it turns out, in a lot of cases, to be quite easy for you to determine what SHA1(foo || bar) is. You
by maaku 13y ago
> Here’s the deal: if I tell you that SHA1(foo) is X, then it turns out, in a lot of cases, to be quite easy for you to determine what SHA1(foo || bar) is. You don’t need to know what foo is. It’s just that, because SHA1 is iterative and works block by block, if you know the hash of foo, then you can extend the computation to determine the hash of foo || bar.
This is simply wrong. Padding of cryptographic hash functions protect against this behavior.
- pbsd 13y agoIt is not simply wrong. The usual Merkle-Damgard padding only means that you get something like SHA1(foo || garbage || bar) instead, garbage being smaller than the hash's block size.
- maaku 13y agoMaybe disingenuous was a better word. The "garbage" in the middle still protects against most (though not all) attacks.