Why does Merkle-Damgård hashing involve putting the padding at the end instead of at the start?
I can only provide a programming sense to this;
One may not know the size of the message beforehand (streaming), when finished, the length-padding can be executed nicely at the end. Otherwise, the system must store all of the messages to calculate the size, this will be very bad for constrained environments.