8 ms·

Neither mention truncated hash

• jakear 3y ago
  Ya, SHA384 is the way to go. By discarding some bits, the internal state isn’t public and length extension becomes impossible.
  • AtNightWeCode 3y ago
    This is my understanding as well but I have seen claims that it is still very possible to do length attacks on SHA384.
    • jakear 3y ago
      Any reference for that? Based on the wiki it has 128 bits of security against length extension. https://en.m.wikipedia.org/wiki/SHA-2 https://en.m.wikipedia.org/wiki/SHA-2