A length-extension attack lets an attacker continue a Merkle–Damgård hash from a known digest. Given H(A), the original message length, and chosen appended data B, the attacker computes a valid digest for the padded original input followed by B without learning A. The digest exposes the hash’s final internal state, so hashing can be resumed rather than reversed. section 7.3.2 section 6.3.1
This breaks secret-prefix MACs of the form H(key || message). A captured valid tag becomes a starting state for extending a signed request; padding must match the length of the hidden key plus original compacted message. The resulting request can pass verification despite the attacker not knowing the API secret. section 7.2 section 7.3.2
Forging a bank transaction
A bank signs transaction parameters with SHA-256 over a client secret and request data. An attacker intercepts a valid amount=10 request, calculates Merkle–Damgård padding from the assumed original input length, resumes SHA-256 from the observed MAC, and appends parameters for amount=424242. The forged MAC authenticates the altered transaction. section 7.3.1 section 7.3.2
Avoid this failure by choosing a MAC construction rather than inventing one:
- Use HMAC, which hashes the secret in multiple passes and resists length-extension and collision attacks. section 10.1.5
- Prefer sponge-based hashes where applicable; they resist length extension even beneath a secret-prefix MAC. section 10.1.5 section 6.3
Figure 7.9 Because the internal state of the hash function is available to the attacker in the digest, the hash calculation can be “resumed.”
The diagram shows why a digest can serve as the state from which processing of appended data resumes. section 7.3.2
