Why does NIST say that 2nd preimage resistance depends on the message length
The reference for the claim is here, titled &quot;Second Preimages on $n$-bit Hash Functions for Much Less than $2^n$ Work&quot; by J. Kelsey, B. Schneier.
The attack is specific to un-truncated Merkle-Damgaard hash functions. I haven't understood the mechanism of the attack, but as far as I understood, it require some unrealistically large working memory for the attack to work, and therefore it doesn't affect real-world security of SHA-1/2 hash functions.