Hacker News new | past | comments | ask | show | jobs | submit login

It is helpful to know the internals of SHA-2. It helps to make sense of the "Length Extension Attack" [1] on this kind of hash function construction.

[1] https://en.wikipedia.org/wiki/Length_extension_attack




It actually isn't important to know much about the internals to grasp this attack, let's see why quickly:

Your cryptographic hash function maintains a bunch of state which is manipulated by shoving data through it. One obvious way to get the output is just serialise all of that state, and this is what the Merkle–Damgård hashes like SHA-256 do.

That's how the Length Extension becomes possible. The details of how that state is created don't matter to the attack, because the hash output itself provides an attacker with the complete internal state and they can extend from there. [There are some small subtleties around padding].

In SHA-3 (and all Keccak variants and similar modern hashes) there is instead a "squeeze" mechanism that takes the internal state of the hash and outputs some bits derived from that state. The state inside SHA-3 is always 1600 bits, that'd be a real pain to write down compared to a 256 bit SHA-256, but the "squeeze" can give you say, 256 bits like you had with SHA-256. Because this isn't the actual internal state of the hash an adversary can't do anything useful with it, such as the Length Extension Attack.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: