Cryptology Academy · Lesson

MAC Concepts & Length-Extension Attacks

Explain why appending a secret prefix is insecure against length extension.

Lesson 1 of 413 steps

MAC Concepts & Length-Extension Attacks is a free Cryptology Academy lesson on CoddyKit. This is lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

Message Authentication Codes (MACs) provide integrity and authenticity with a shared secret key. In this lesson we understand MACs, their properties, and a critical vulnerability in naive keyed hashes.

What Is a MAC?

A MAC is a short authentication code computed from a message and a secret key. Receiver with the same key recomputes the MAC and verifies. Prevents forgery without the key.

MAC vs Hash vs Signature

Hash: no key, public, provides integrity only. MAC: shared secret, symmetric, provides integrity + authenticity. Digital signature: private key, asymmetric, adds non-repudiation. Only signatures provide non-repudiation.

Unforgeability

A secure MAC must be existentially unforgeable under chosen-message attack (EUF-CMA): an attacker who can query the MAC for any message cannot forge a valid MAC for a new message not previously queried.

Naive Keyed Hash: Prefix MAC

Naive attempt: MAC(K, M) = H(K || M). Looks secure but is vulnerable to length-extension attacks for Merkle-Damgård hash functions (SHA-256, SHA-512, MD5).

Length-Extension Attack

SHA-256 state after hashing M is just H(M). Given H(K || M), an attacker can compute H(K || M || padding || extra) for any 'extra' without knowing K. They extend the message to append new data.

Attack Practical Impact

Flickr (2009): API used H(K || params). Attackers appended &api_sig=forgery to authenticated requests. Result: unauthorized API calls appeared valid. Purely a length-extension exploit.

Suffix MAC Also Fails

MAC(K, M) = H(M || K): vulnerable to offline attacks. Attacker computes H(message) without K, then uses birthday attack to find M' with same hash. Key is appended after the collision.

Why HMAC Fixes This

HMAC wraps the hash twice with different key pads: HMAC(K, M) = H((K⊕opad) || H((K⊕ipad) || M)) The inner hash produces H(ipad_key || M). The outer hash wraps it with opad_key. Length extension fails because the attacker cannot set the outer hash's initial state.

SHA-3 and Length Extension

SHA-3 uses the sponge construction, which is inherently immune to length-extension attacks. H_SHA3(K || M) is a valid simple MAC construction. SHA-2 is not — always use HMAC with SHA-2.

Timing Attacks on MAC Verification

Early-exit MAC comparison (==) leaks timing. 'Correct' first byte takes slightly longer than 'wrong' first byte. After 256 queries: byte 1 found. 256 more: byte 2. Full MAC recovered in 16×256 queries.

Quick Check

Why is MAC(K, M) = SHA256(K || M) insecure?

Answer it in the interactive lesson

Recap

Length-extension attacks show why naive keyed hashes fail. Next we study HMAC's construction and security proof.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “MAC Concepts & Length-Extension Attacks” lesson free?

Yes — the full text of “MAC Concepts & Length-Extension Attacks” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “MAC Concepts & Length-Extension Attacks”?

Explain why appending a secret prefix is insecure against length extension. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 1 of 4.

How long does the “MAC Concepts & Length-Extension Attacks” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy