I have understood that it's trivial to reconstruct the internal state of a hasher for many hash functions, if one only knows the output hash. Then, one can append data after the original data and obtain a valid hash for the original data plus the appended data.  However, recently .  If hash functions append the length, why doesn't that stop the length extension attacks? For a good hash function, if the attacker knows hash(message || length), there should be no way to obtain hash(message) to be able to calculate hash(message || appended_data) which would allow calculating hash(message || appended_data || total_length).  Related:  ...although the related question doesn't discuss appending of the length which MD5, SHA1, etc. do.
114678
I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully get advice on where I'm going wrong.  Lets assume that for a message $m$, a secret $s$ is appended to it and the SHA-1 hash is calculated. If $\textrm{len}(m) + \textrm{len}(s)$ is not a multiple of the block size, a certain amount of padding is added to it to make it a multiple, and the hash is generated using what is essentially $s || m || \textrm{padding}$.  Now SHA-1 internally uses 5 registers — it takes in an block, generates new register values, turns the crank, takes in another block, generates new register values, turns the crank ... and so on till the end. When all blocks are exhausted, the register values are concatenated and spit out.  Assume that an attacker knows a certain value of $m$, for which he also knows the hashed key. In such a case, he knows the state of the 5 registers when $(s || m || \textrm{padding}$ was processed. Lets also assume that the attacker knows the length of $s$, so that he can predict how much padding was added.  Here is where I get confused. From what I've read so far, the attack involves taking the known hash, adding a certain amount of padding and then the value that we want. However, isn't the padding already used up in creating the hash? Why are we using padding in our attack?
114868
In a hash function, you map an input of arbitrary length to an output of finite length such that the relationship is one-to-one (or at least that's what you are trying to achieve).  Hence, isn't it impossible to have a perfect hashing algorithm? Aren't MD5, SHA-*, all flawed in this respect?  Is an "ideal hash" impossible to achieve?
4243
I want to find the md5 hash of the string "a", but running echo "a" | md5sum gives me another hash than what I get if I search the internet (for example using  or ).  Running echo "a" | md5sum gives me "60b725f10c9c85c70d97880dfe8191b3", but it should be "0cc175b9c0f1b6a831c399e269772661".  If I make a reverse hash lookup for "60b725f10c9c85c70d97880dfe8191b3", I do however get "a".
55728
defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks:     it is possible to use an XOF as a hash function by   selecting a fixed output length. However, XOFs have the potential for generating related   outputs—a property that designers of security applications/protocols/systems may not expect of   hash functions   Later it describes a theoretical use case (and explicitly discourage such uses):     For example, a naïve (and non-approved) way   for two parties to agree to derive a 112-bit Triple DES key from a message designated as keymaterial would be to compute SHAKE128(keymaterial, keylength), where keylength is 112.   However, if an attacker is able to induce one of the parties to use a different value for keylength, say 168 bits, but the same value for keymaterial   So what is the use case for these functions? Is there any reasonable use case where these functions should be used instead of standard (fixed-size output functions) SHA-3 functions?
45089
Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the database is compromised.  Which properties of a cryptographic hash function make it suitable for hashing passwords and the like?  Which functions are secure enough, while still being widely available, without patent issues and not too computationally intensive?
14177
What is the best way to combine both hashes into %hash1?  I always know that %hash2 and %hash1 always have unique keys.  I would also prefer a single line of code if possible.    $hash1{'1'} = 'red'; $hash1{'2'} = 'blue'; $hash2{'3'} = 'green'; $hash2{'4'} = 'yellow';
2818
I know in JavaScript, objects double as hashes, but I have been unable to find a built-in function to get the keys: var h = {a:'b', c:'d'};  I want something like var k = h.keys() ; // k = ['a', 'c'];  It is simple to write a function myself to iterate over the items and add the keys to an array that I return, but is there a standard cleaner way to do that? I keep feeling it must be a simple built in function that I missed but I can't find it!
53113
After saw the xkcd comic , I wonder if it is theoretically possible to construct a self-descriptive string that contains its own hash value?  Let's say the string's MD5 value is 663ef7d3f38cf900574cd4d9f83eb1b7, the string would be something like:  ... The md5sum value of this file is 663ef7d3f38cf900574cd4d9f83eb1b7 ...
30407
Creating hashes of hashes in Ruby allows for convenient two (or more) dimensional lookups.  However, when inserting one must always check if the first index already exists in the hash. For example:  h = Hash.new h['x'] = Hash.new if not h.key?('x') h['x']['y'] = value_to_insert   It would be preferable to do the following where the new Hash is created automatically:  h = Hash.new h['x']['y'] = value_to_insert   Similarly, when looking up a value where the first index doesn't already exist, it would be preferable if nil is returned rather than receiving an undefined method for '[]' error.    looked_up_value = h['w']['z']   One could create a Hash wrapper class that has this behavior, but is there an existing a Ruby idiom for accomplishing this task?
17676
Is every output of a hash function (e.g. SHA1, MD5, etc) guaranteed to be possible, or, conversely, are there any output values that cannot possibly be created from any input? In other words, are hash functions surjective?  If so, what guarantees this? If not, is it possible to discover such impossible outputs via an attack faster than brute force?
33565
Is there a construction of an order preserving hash function that keeps the preimage property of a crypto hash function? By order preserving hash function (OPHF) i mean for $x&lt;y$ then $OPHF(x) &lt; OPHF(y)$
112608
What is a good Hash function? I saw a lot of hash function and applications in my data structures courses in college, but I mostly got that it's pretty hard to make a good hash function. As a rule of thumb to avoid collisions my professor said that:  function Hash(key)   return key mod PrimeNumber end   (mod is the % operator in C and similar languages)  with the prime number to be the size of the hash table. I get that is a somewhat good function to avoid collisions and a fast one, but how can I make a better one? Is there better hash functions for string keys against numeric keys?
83146
Appending the length of the message when padding of a SHA-2 message is sufficient to satisfy the Merkle-Damgård construction.  However the padding in SHA-2 also pads with 10* between the end of the message and the message length data.  I know that 10* padding lets one turn non-block-aligned length messages into block-aligned length messages in a reversible way.  However, because the padding already encodes the bit length of the original message, this 10* padding is redundant.  Using the bit length data we can already determine where the original message ends and 0* padding would be sufficient.  In fact, in "One Way Hash Functions and DES. Advances in Cryptology" in Crypto’89, Merkle uses 0* padding followed by the length.  So my question, why does SHA-2 call for doing 10* padding in addition to appending the message length?
104837
Any decent hash algorithm will produce basically "random like" values for any given input including the empty input.  For example MD5 produces d41d8cd98f00b204e9800998ecf8427e on an empty input.  I wonder, however, why the MD5 algorithm wasn't defined to have a final step where the output is XORed with d41d8cd98f00b204e9800998ecf8427e. This should not affect the cryptographic strength of the hash algorithm, and it would have the convenient property that a hash of all zeros represented a zero input.  Would it simply just because adding that step would slow the hash down a bit?
28913
I want to verify integrity of folder. The folder has so many files and folders. How to calculate hash value of directory as a whole on Ubuntu. md5sum calculate at only file level.
39353
To be clear, I have access to $H(S)$ and as many $H(S||K)$ as I want. Every string $K$ is known. Can I use the extra information to my advantage and try to deduce $S$, without requiring bruteforce? Or do you still have to bruteforce but try less combinations since you have more information?
37042
From what I know, the HMAC constructions has two strength:   It's resistant to length extensions Since the key is consumed before the message, the attacker does not know the initial state, preventing simple collision attacks.   But the simple construction $ \mathrm{Hash}(\mathrm{Hash}(\mathrm{key} ∥ \mathrm{message})) $ would offer those properties too.  HMAC on the other hand uses the more complicated construction $ \mathrm{Hash}((\mathrm{key} ⊕ \mathrm{opad}) ∥ \mathrm{Hash}((\mathrm{key} ⊕ \mathrm{ipad}) ∥ \mathrm{message})) $. I assume the more complicated construction of HMAC is required for some security proof, but I don't immediately see why.  For SHA-3 candidates, Hash(key||message) is claimed to be secure, since they're resistant to length extensions, without consuming the key twice. I believe Skein even has some security proof for a very similar mode.  So why does HMAC need to inject the key twice?