A length-extension attack exploits the iterative Merkle–Damgård design used by SHA-2. Given a digest of an original message and its length, an attacker can continue hashing to produce a valid digest for the original message, padding, and appended data. section 2.5.1 section 3.6
The attack works because:
- Merkle–Damgård hashing processes padded input block by block, carrying the previous compression result into the next step. section 2.5.1
- The published digest exposes the hash's effective intermediate state after the original input. section 3.6
- An attacker can treat the original padding as part of the input and continue hashing appended data without knowing a secret prefix. section 3.6
Tampering with a signed cookie
Suppose a server checks SHA-256(secret || "user=bob"). An attacker can extend the known digest with the appropriate padding and "&admin=true", producing a digest that validates the extended message even though the secret remains unknown. section 3.6
Figure 3.13 An attacker successfully uses a length-extension attack to tamper with their cookie and computes the correct hash using the previous hash.
Trace the attacker’s successful cookie modification and reuse of the previous hash. section 3.6
Do not hash secrets with SHA-2 as a homemade MAC. Padding details can block some protocols, but small protocol changes can restore exploitability; use a construction resistant to this weakness. section 3.6 section 2.7
