Message Padding

SHA-256 requires the input to be a multiple of 512 bits (64 bytes). For arbitrary-length input:

pad(message):
    L = bit length of message
    1. Append a single bit '1'  (=== byte 0x80)
    2. Append zero bits until length ≡ 448 (mod 512)
    3. Append L as a 64-bit big-endian integer

After padding the length is ≡ 0 (mod 512).

Why these specific values?

• The 1 bit + zeros gives a unique boundary so different-length messages with the same prefix don't collide.
• The 64-bit length field makes the padding depend on the message length, so "a" and "a" + 0x80 cannot pad to the same block. It does not stop length extension: the padding is fully determined by the length, so an attacker who knows the length can reconstruct it. Length extension is a property of Merkle-Damgard, not of the padding — the fix is HMAC, covered later in this course.

Example: hashing "abc" (3 bytes = 24 bits):

input bytes:  61 62 63
+ 1 bit:      80
+ zeros:      00 00 00 ... 00     (until total = 56 bytes)
+ 64-bit len: 00 00 00 00 00 00 00 18    (24 bits)
total:        64 bytes