it is often said that when using the MD5 algorithm to sign some arbitrary information, the shared secret has to be at the end. Why?
$\begingroup$
$\endgroup$
2
-
2$\begingroup$ Can you please be more specific instead of saying 'often said'. Can you cite references, and also expand on why the issue is relevant ? $\endgroup$– Suresh VenkatAug 16, 2010 at 20:38
-
$\begingroup$ There's a typo in your question title: can you change "and" to "end"? $\endgroup$– Carlos ScheideggerAug 16, 2010 at 21:54
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
See "extension attacks" in the Merkle-Damgard construction. This issue arises in the use of hash functions for message authentication.
In short, putting the secret in the beginning allows the attacker, given a message and its hash, to forge any message which has the given message as a prefix. This is a problem for naive codes but is avoided by well-known codes like HMAC.
-
1$\begingroup$ From what I understand if you break the input stream and the shared key is the beginning of the stream then the first block will almost always get the same hash and so the shared key can be guessed by the use of rainbow attacks, right? $\endgroup$ Aug 16, 2010 at 20:58