THE FOLD / CHEAT / GOD MODE / THE LENGTH EXTENSION
THE LENGTH EXTENSION
a signature that continues itself
1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION
A Merkle–Damgård hash chews a message block by block, and the digest it hands you is the internal state it stopped at. So anyone holding H(secret‖message) can carry on hashing from exactly where it left off — appending whatever they like and producing a valid tag for the longer message, without ever knowing the secret. The flaw is not in the compression function. It is in the shape.
LIT verified live: forging a tag for a message with an appended suffix, using only the digest and the length of what was hashed, produces 1554148550 against a true value of 1554148550; the attacker never touches the key; and a nested construction in the style of HMAC breaks the chain, giving a forged 334287878 against a real 76897988 — because the outer hash starts from a fresh state the attacker cannot resume.
LIT verified live: forging a tag for a message with an appended suffix, using only the digest and the length of what was hashed, produces 1554148550 against a true value of 1554148550; the attacker never touches the key; and a nested construction in the style of HMAC breaks the chain, giving a forged 334287878 against a real 76897988 — because the outer hash starts from a fresh state the attacker cannot resume.
2 HOW IT WAS WEAVED · AI + HUMAN
David (human) seated this at GOD MODE: a valid signature produced without possessing the thing that is supposed to make signatures possible.
AVAN (AI) should be exact about what this page demonstrates. The hash here is a toy — a small compression function and a short pad — built so the attack can be watched end to end rather than asserted. What it shows is that the extension property follows from the construction, not from any weakness in the mixing. That is the whole point, and it is why the same attack applies to SHA-256, whose compression function has no known weakness at all, while SHA-3 is immune for a structural reason: a sponge keeps capacity bits the digest never reveals, so there is no state to resume. Nothing here says anything about the strength of any real hash function.
AVAN (AI) should be exact about what this page demonstrates. The hash here is a toy — a small compression function and a short pad — built so the attack can be watched end to end rather than asserted. What it shows is that the extension property follows from the construction, not from any weakness in the mixing. That is the whole point, and it is why the same attack applies to SHA-256, whose compression function has no known weakness at all, while SHA-3 is immune for a structural reason: a sponge keeps capacity bits the digest never reveals, so there is no state to resume. Nothing here says anything about the strength of any real hash function.
3 ONE DIMENSION
The chain, and the point at which it hands you its own state.
4 TWO DIMENSIONS · INTERACTIVE
Forge a tag without the key, then switch to the nested construction and watch it fail.
5 THREE DIMENSIONS + AVAN’S INVERSE
The green forward object: a chain whose last link is published.
AVAN’s addition (the inverse-companion): the forward reading is “do not use a raw hash as a MAC.” The inverse is that the digest was doing two jobs and nobody decided it should. It is meant to be a commitment — a short unforgeable summary — and it happens also to be a resumable position, because the construction had to end somewhere and the state was the obvious thing to hand back. Read backwards, the vulnerability is an unexamined coincidence of representation: two roles collapsed onto one value, and the attack is simply someone using the second role while everyone was reasoning about the first.
LIT forging a tag for a message with an appended suffix, using only the digest and the length of what was hashed, produces 1554148550 against a true value of 1554148550; the attacker never touches the key; and a nested construction in the style of HMAC breaks the chain, giving a forged 334287878 against a real 76897988, because the outer hash starts from a fresh state the attacker cannot resume
FIG The hash here is a TOY — a small compression function and a short pad — built so the attack can be watched end to end rather than asserted. What it shows is that the extension property follows from the CONSTRUCTION, not from any weakness in the mixing, which is why the same attack applies to SHA-256 (whose compression function has no known weakness) while SHA-3 is immune structurally: a sponge keeps capacity bits the digest never reveals, so there is no state to resume. Nothing here says anything about the strength of any real hash function.
FIG The hash here is a TOY — a small compression function and a short pad — built so the attack can be watched end to end rather than asserted. What it shows is that the extension property follows from the CONSTRUCTION, not from any weakness in the mixing, which is why the same attack applies to SHA-256 (whose compression function has no known weakness) while SHA-3 is immune structurally: a sponge keeps capacity bits the digest never reveals, so there is no state to resume. Nothing here says anything about the strength of any real hash function.
◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of GOD MODE · David Lee Wise (ROOT0), with AVAN