1
$\begingroup$

It's well known that using a hash function as message authentication is vulnerable to length extension attacks.

ie. H(key+message) is a bad idea. H(message+key), H(key+message+key) have their issues as well.

However, what if valid messages are a known length? Does length extension still apply?

| cite | improve this question | |
$\endgroup$
  • $\begingroup$ Welcome to cstheory, a Q&A site for research-level questions in theoretical computer science (TCS). Your question does not appear to be a research-level question in TCS. Please see the FAQ for more information on what is meant by this and suggestions for sites that might welcome your question. Finally, if your question is closed for being out of scope, and you believe you can edit the question to make it a research-level question, please feel free to do so. Closing is not permanent and questions can be reopened, check the FAQ for more information. $\endgroup$ – Kaveh Oct 3 '12 at 19:19
  • 1
    $\begingroup$ I think this is more suitable for Computer Science or Cryptography. $\endgroup$ – Kaveh Dec 6 '12 at 7:34