On that note, I was surprised to learn that if all you do is apply some invertible transform to the IV (xor with a constant, swap words, whatever) before processing the last padded block in Merkle-Damgard, you get an indifferentiable hash.<p>This was suggested by John Kelsey way back in 2001 for SHA-2, but never took off: <a href="http:&#x2F;&#x2F;www.cs.utsa.edu&#x2F;~wagner&#x2F;CS4363&#x2F;SHS&#x2F;dfips-180-2-comments1.pdf" rel="nofollow">http:&#x2F;&#x2F;www.cs.utsa.edu&#x2F;~wagner&#x2F;CS4363&#x2F;SHS&#x2F;dfips-180-2-commen...</a>