<html><head></head><body>Hi,<br>
<br>
My guess is that those hash algorithms that leak all their internal state will also be a better target for pre-image and collission and similar attacks, than those where you do not get the full state.<br>
<br>
<br><br><div class="gmail_quote"><br>
<br>
ianG <iang@iang.org> schrieb:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On 4/06/2014 14:14 pm, Philipp Gühring wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">Hi,<br /><br />I dont't mind dropping *256, but I currently believe that SHA384 is the<br />only secure hash in the SHA2 family, all other hashes leak their<br />complete internal state. Length-Extension-Attack...</blockquote><br /><br />Point. But, is a length extension attack relevant to HMAC use? Doesn't<br />the HMAC shield from this very attack?<br /><br /><br /><br />iang<br /><hr /><br />Ach mailing list<br />Ach@lists.cert.at<br /><a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a><br /><br /></pre></blockquote></div></body></html>