16
$\begingroup$

it is often said that when using the MD5 algorithm to sign some arbitrary information, the shared secret has to be at the end. Why?

$\endgroup$
  • 2
    $\begingroup$ Can you please be more specific instead of saying 'often said'. Can you cite references, and also expand on why the issue is relevant ? $\endgroup$ – Suresh Venkat Aug 16 '10 at 20:38
  • $\begingroup$ There's a typo in your question title: can you change "and" to "end"? $\endgroup$ – Carlos Scheidegger Aug 16 '10 at 21:54
16
$\begingroup$

See "extension attacks" in the Merkle-Damgard construction. This issue arises in the use of hash functions for message authentication.

In short, putting the secret in the beginning allows the attacker, given a message and its hash, to forge any message which has the given message as a prefix. This is a problem for naive codes but is avoided by well-known codes like HMAC.

| cite | improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ From what I understand if you break the input stream and the shared key is the beginning of the stream then the first block will almost always get the same hash and so the shared key can be guessed by the use of rainbow attacks, right? $\endgroup$ – Alexandru Aug 16 '10 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.