SequenceHash: multihashing for the rest of us
Trail of Bits releases SequenceHash and SequenceMAC, hash-agnostic multihashing constructions that prevent ambiguous input encoding and length-extension attacks in cryptographic protocols. SequenceHash uses 128-bit length-suffix encoding and a double-hash construction to provide unambiguous multihashing with any secure hash function, unlike NIST's TupleHash which requires Keccak. SequenceMAC adds keyed mode with a 32-byte minimum key, fixing HMAC key pseudocollision issues. Implementations in Rust, Go, and Python are released with test vectors under C2SP.
Detection / Hunteropenrouter
Immediate Actions
- Audit cryptographic protocol code for naive hash concatenation of multiple inputs
- Replace ad-hoc multihashing with SequenceHash or SequenceMAC implementations
Key Takeaways
- Works with SHA2, BLAKE, RIPEMD — not tied to Keccak like NIST's TupleHash
- Uses 128-bit fixed-length byte counts for length-suffix encoding, enabling streaming APIs
- SequenceMAC requires minimum 32-byte keys; incorporates key length to prevent HMAC pseudocollisions
- Implementations available in Rust, Go, and Python with test vectors including intermediate values
- Critical for Fiat-Shamir transforms where multihashing errors enable zero-knowledge proof forgeries
Attack Chain
- Vulnerability: Protocol concatenates multiple hash inputs without unambiguous length encoding
- Ambiguity: Different input boundaries produce identical digests for logically distinct values
- Exploitation: Attacker shifts input boundaries to forge proofs or open commitments differently
- Impact: Zero-knowledge proof forgeries and commitment scheme bypasses in cryptocurrency protocols
- Remediation: Adopt SequenceHash with length-suffix encoding and double-hash construction
Affected Systems
- Cryptographic protocols using naive hash concatenation
- Zero-knowledge proof systems with Fiat-Shamir transforms
- Commitment schemes with hash-based blinding values
- Cryptocurrency transaction grouping and authentication systems
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | Cryptographic construction flaws are not observable via endpoint detection tools. |
| Network Visibility | None | Hash input encoding errors occur in application logic, not network traffic. |
| Detection Difficulty | Very Hard | Requires source code audit of cryptographic protocol implementations to identify. |
Control Gaps
- Static analysis tools do not flag naive hash concatenation patterns
- Code review processes miss multihashing encoding flaws in cryptographic protocols
- No runtime detection for ambiguous hash input boundaries
False Positive Assessment
Low — article is a cryptographic tool release, not a detection rule or threat report.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Adopt SequenceHash specification for new cryptographic protocol development
- Enforce length-prefix or length-suffix encoding in all hash input functions
User Protection
- Update cryptographic libraries to use SequenceHash instead of raw concatenation
Security Awareness
- Train developers on multihashing risks and length-extension attack vectors
Plain-Language Summary
Trail of Bits released SequenceHash and SequenceMAC, free tools that let developers safely combine multiple values into a single hash using any standard hash function. Without proper safeguards, simply concatenating values before hashing can let attackers forge digital proofs, potentially causing financial losses in cryptocurrency systems. The open-source implementations in Rust, Go, and Python are available now. Developers building cryptographic protocols should adopt these tools to prevent input ambiguity attacks.