Mention that blake2 is not vulnerable to length-extension attacks (#3118)
* Mention that blake2 is not vulnerable to length-extension attacks
* SHA is sort of like a word, in the sense that I want the spellcheck to shut up about it
* rephrase
diff --git a/docs/hazmat/primitives/cryptographic-hashes.rst b/docs/hazmat/primitives/cryptographic-hashes.rst
index b0e9c16..fd5f35d 100644
--- a/docs/hazmat/primitives/cryptographic-hashes.rst
+++ b/docs/hazmat/primitives/cryptographic-hashes.rst
@@ -120,7 +120,9 @@
BLAKE2
~~~~~~
-`BLAKE2`_ is a cryptographic hash function specified in :rfc:`7693`.
+`BLAKE2`_ is a cryptographic hash function specified in :rfc:`7693`. BLAKE2's
+design makes it immune to `length-extension attacks`_, an advantage over the
+SHA-family of hashes.
.. note::
@@ -224,3 +226,4 @@
.. _`Lifetimes of cryptographic hash functions`: http://valerieaurora.org/hash.html
.. _`BLAKE2`: https://blake2.net
+.. _`length-extension attacks`: https://en.wikipedia.org/wiki/Length_extension_attack
diff --git a/docs/spelling_wordlist.txt b/docs/spelling_wordlist.txt
index 04ec0e6..f60943a 100644
--- a/docs/spelling_wordlist.txt
+++ b/docs/spelling_wordlist.txt
@@ -69,6 +69,7 @@
scrypt
serializer
Serializers
+SHA
Solaris
Tanja
testability