Unverified50% confidenceFactExact time
The SHA-256 length extension attack allows the hash(secret + message) form to forge extended messages without knowing the key, and switching to the hmac.new construction defends against it.
1
Sources
50%
Confidence
Long-term
Relevance
10/13/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedCommit SHA 基于 SHA-1 的内容寻址特性，具备密码学层面的完整性保证，即便标签被恶意篡改，锁定 SHA 的工作流也不会受影响，Git 正逐步向 SHA-256 迁移71% similarUnverified数字签名工程实现中通常先计算消息的密码学哈希（如 SHA-256）再对哈希值签名，因为非对称加密运算开销远大于哈希运算70% similarUnverifiedAn Integrity Hash is the cryptographic digest of each package recorded in the npm lock file, typically using the SHA-512 algorithm and stored with the sha512- prefix.69% similarVerifiedSHA-256 is a cryptographic hash function in the SHA-2 family with an output length of 256 bits, possessing collision resistance and preimage resistance.68% similarUnverifiedSHA-256 hash verification only validates byte integrity, not the semantic safety of those bytes — a matching diff can still contain logic vulnerabilities or incorrect database migration directions.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1021594API
curl https://kongchang.com/api/v1/knowledge/claims/1021594MCP
get_claim(id=1021594)