3 ms·
Is this use of MD5 subject to the known length extension attack? If so, what would a better alternative use for an HMAC hash? Discussed here: http://tools.ietf
by gburt 13y ago
Is this use of MD5 subject to the known length extension attack? If so, what would a better alternative use for an HMAC hash?
Discussed here: http://tools.ietf.org/html/rfc6151 http://tools.ietf.org/html/rfc6151
- the_mitsuhiko 13y agoThe articles recommends using a form of HMAC and not MD5 directly. The first code example is just a basic example of what the general concept behind is.
- lucian1900 13y agoI guess this is yet another reminder that the first example sticks (waterfall model).
- pbsd 13y agoThat particular case isn't vulnerable to length extension, since the key is placed at the end of the message. This MAC breaks down, however, when the function used is not collision-resistant. HMAC offers some level of protection against collision-weak hash functions, and that's why you can still use HMAC-MD5 today and be pretty OK (although I don't recommend it!).
- meowface 13y agoIf it was `message = payload + "." + MD5(secret_key + payload)` then yes, it would be vulnerable. It is `message = payload + "." + MD5(payload + secret_key)` though, so it is not vulnerable. The attacker cannot extend the payload part.