2

Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc".

(In PHP: hash('sha256', $unknownString .'abc');)

I thought in order to do so "all I need" is to go from the hash that I know back to the midstate of the sha256 algorithm (in most implementations called finalize) and append the data that I want (via, in most implementations called, update) and then call finalize again. Block lengths shouldn't be a problem because the unknown string has a length of 256 bit and my own string has this as well.

Is this possible or by the way sha256 is designed impossible to achieve?

PS: I have no intention in getting the unknown string. I absolutely do not care about the plaintext contents of this.

poncho
  • 138,335
  • 11
  • 217
  • 344
jabbink
  • 123
  • 4
  • Thanks @poncho for the added keyword. I did not know this was called like that and I think I found exactly what I wanted. Thanks! – jabbink Jun 24 '13 at 22:31
  • 1
    related: [md5: is reverse length-extension attack possible?](http://crypto.stackexchange.com/questions/3828/md5-is-reverse-length-extension-attack-possible) – CodesInChaos Jun 24 '13 at 22:37
  • 1
    @jabbink: Hopefully, you found that the answer to your question is: no (by any known method), for the extension `abc`; but yes for some slightly longer extensions (possibly ending in `abc`), and assuming the length of $unknownString is known. – fgrieu Jun 25 '13 at 05:15

1 Answers1

1

SHA-256 is computed by first padding a message $m$ and then breaking $\operatorname{pad}(m)$ into $\ell$ blocks $m_1, m_2, \dots, m_\ell$ of 512 bits each. The padding appends some bits to the message so that it is an integral multiple of 512 bits long. Then the SHA-256 hash of $m$ is $$f(\cdots f(f(\mathit{iv}, m_1), m_2) \cdots, m_\ell)$$ where $f$ is the SHA-256 compression function and $\mathit{iv}$ is the standard initialization vector. This means that given $\operatorname{SHA256}(m)$ you can compute $\operatorname{SHA256}(\operatorname{pad}(m) \mathbin\| m')$ for any suffix $m'$. But you can't necessarily compute $\operatorname{SHA256}(m \mathbin\| m'')$ unless $m''$ coincides with the padding on $m$.

Squeamish Ossifrage
  • 46,897
  • 3
  • 110
  • 214