Conversation

i wonder how much more secure sha3-512(t) is vs sha2-512(len(t) || t)

2
0
1

also when length extension attacks were discovered on merkele-dåmgard hashes 🤔

0
0
1

@charlotte the latter can still be vulnerable to length extension attacks if used as you suggest, depending on how exactly do you combine the length and the message.
In retrospect it's weird that sha2-512 hash is just a raw unfiltered internal state of the hashing algorithm.

1
0
0

@IngaLovinde len(t) is a 64 bit little endian number that is prepended to the message, so that extending t fundamentally alters the prefix

0
0
1