Hash functions, MACs, and length-extension boundaries

Mechanism

A cryptographic hash does not authenticate its input without a secret-dependent construction. Some iterative hashes permit extending a digest when the original message length is known, making naive secret-prefix hashing unsafe as a MAC. HMAC has a different nested construction and is not vulnerable to the same direct extension technique.

Practical method

Identify the digest family and the application message format. Determine whether the tag is an actual MAC or a simple concatenated hash. For a toy secret-prefix construction, model padding and test plausible secret lengths. Verify modified-message acceptance rather than comparing digests without application parsing.

import hmac, hashlib
tag = hmac.new(key, message, hashlib.sha256).digest()
valid = hmac.compare_digest(tag, received_tag)

Interpreting evidence

An extension must preserve a message that the application can parse; embedded padding bytes may prevent meaningful use. Document the original length, guessed secret length, appended bytes, and acceptance decision.

Pitfalls and limits

Not every hash supports length extension. A hash collision is different from MAC forgery or preimage recovery. Plain equality may leak timing, though a reliable exploit depends on the surrounding network and implementation.