Merkle-Damgård Construction

SHA-256 is a Merkle-Damgård hash: a way to build a hash function over arbitrary-length input from a fixed-size compression function.

                +---------+
M_0  -+-->  ----| compress|--->H_1
H_init|        +---------+
                +---------+
M_1  -+-->  ----| compress|--->H_2
H_1   |        +---------+
       ...
                +---------+
M_n  -+-->  ----| compress|--->H_n+1
H_n   |        +---------+
                            output = H_n+1

For each padded block in sequence: feed the current hash state + that block into compress; result becomes the next state. Final state is the hash output.

Properties this gives you:

• Variable-length input from fixed-size compression.
• Streaming: only need one block of memory; can hash gigabytes.

Vulnerabilities:

• Length extension: if you know H = SHA(M) for an unknown M, you can compute SHA(M || P || M') for some padding P and any M'. This is why HMAC exists for MACs.

SHA-3 (Keccak) uses a different construction (sponge) that avoids length extension. Modern designs (BLAKE3) also avoid it.