Let's say I have: C = A + B where A and B contain strings and the plus sign means concatenation. I already hashed A with SHA1 and SHA256 and got a digests. I forget what the original A string was, but I want to get the digests like I wanted to hash the entire C string. Can I initialize these hash functions to A's digest and continue hashing the B string and get the same digests as if I had been hashing C from the start?

  • 2
    I believe (believe) this would be a length extension attack, which is indeed possible with SHA1 and SHA256. Jan 16 '16 at 16:14
  • I have found hlextend Python module that seems to help in generating the new digest. In the example on their github, which string is my A string? 'file' or 'hello'? Would it work if I leave the other one a blank string? Jan 16 '16 at 17:22
  • @WanderNauta, it is indeed a length extension attack and it is possible (although I don't know enough details to answer). Also see "Merkle-Damgard construction" on Wikipedia
    – SEJPM
    Jan 16 '16 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.