Why does NIST say that 2nd preimage resistance depends on the message length In NIST FIPS 202 on the table, It is written as




Function
Output Size
Collision
PreImage
2nd Preimage




SHA-1
160
&lt; 80
160
160–L(M)


SHA-224
224
112
224
min(224, 256–L(M))


SHA-512/224
224
112
224
224


SHA-256
256
128
256
256–L(M)


SHA-512/256
256
128
256
256


SHA-384
384
192
384
384


SHA-512
512
256
512
512–L(M)




with $L(M) = \lceil \log_2(len(M)/B) \rceil$ where $B$ is the block length of the function in bits, i.e., B = 512 for SHA-1, SHA-224, and SHA-256, and B = 1024 for SHA-512.
For the discussion directs to NIST 800-107r1. and it is on the appendix;

The actual second preimage resistance strength for SHA-1, SHA -224, SHA-256 and
SHA-512 is approximately $(L – M)$, where $L$ is the output block size of the hash function,
and the message is $2^M$ input blocks in length.


For example, if a message that is $2^{33}$ bits in length (i.e., a gigabyte long) is hashed by
SHA-256 (whose input block size is $2^9$ bits), the second preimage resistance strength is
$(L – M) = (256 – 24) = 232$ bits (where $L = 256$, and $M = \log_2(2^{33}/2^{9}) = (33 – 9) = 24).$ That is, the amount of work required to find a second preimage is $2^{232}$.


It is important to note that the amount of work is based on the number of compressions
function executions (compressing single message blocks), not on the number of hash
function executions (hashing messages of more than one block in length)

First of all, there is no reference for this claim. Is there any reference for this claim?
Is there a better explanation for this attack?
The reference for the claim is here, titled &quot;Second Preimages on $n$-bit Hash Functions for Much Less than $2^n$ Work&quot; by J. Kelsey, B. Schneier.
The attack is specific to un-truncated Merkle-Damgaard hash functions. I haven't understood the mechanism of the attack, but as far as I understood, it require some unrealistically large working memory for the attack to work, and therefore it doesn't affect real-world security of SHA-1/2 hash functions.