Merkle-Damgård Construction

SHA-256 is a Merkle-Damgård hash: a way to build a hash function over arbitrary-length input from a fixed-size compression function.

  H_init ──┐
           v
  M_0 ──> [compress] ──> H_1 ──┐
                               v
  M_1 ──────────────────> [compress] ──> H_2 ──┐
                                               v
  M_n ──────────────────────────────────> [compress] ──> H_final

  output = H_final   (the 8 words, big-endian, concatenated)

For each padded block in sequence: feed the current hash state + that block into compress; result becomes the next state. Final state is the hash output.

Properties this gives you:

• Variable-length input from fixed-size compression.
• Streaming: only need one block of memory; can hash gigabytes.

Vulnerabilities:

• Length extension: if you know H = SHA(M) for an unknown M, you can compute SHA(M || P || M') for some padding P and any M'. This is why HMAC exists for MACs.

SHA-3 (Keccak) uses a different construction (sponge) that avoids length extension. Modern designs (BLAKE3) also avoid it.