lengthextension

Lengthextension, commonly known as the length extension attack, is a cryptographic vulnerability that affects certain hash functions when they are used in an insecure way to provide data integrity or authentication. It arises from the Merkle-Damgård construction used by many traditional hash algorithms, where the final hash value depends on the internal state after processing the input and on how padding is applied.

The attack exploits the ability to take a known hash value of a message and, without knowing the original secret or key, continue hashing additional data as if it were appended to the original message. In practical terms, if a system relies on a straightforward hash of a secret concatenated with a message (for example hash(secret || message)) to verify integrity, an attacker can often construct a new, forged message and a corresponding hash that will be accepted as valid by an insecure verifier. This is possible only if the verifier does not use a secure authentication construction and if the hash function’s padding and internal state can be extended correctly.

Affected hash families include early and widely used functions such as MD5 and SHA-1, as well as other Merkle-Damgård constructions when used in simple hash-based message authentication schemes. Modern designs and practices have mitigations that prevent length extension from enabling forgery.

Mitigations center on using authentication schemes that are resistant to length extension. The recommended approach is to use a proper MAC, such as HMAC, rather than a raw hash of a secret and a message. Alternatives include authenticated encryption or hash constructions designed to resist extension attacks. In practice, adopting these protections is essential for maintaining data integrity and authenticity.