# md5: is reverse length-extension attack possible?

If I know

H = md5( SECRET_KEY | DATA )


then I can calculate

H' = md5( SECRET_KEY | DATA | DATA' )


That's length-extension attack. But is the opposite possible? E.g. if I know

H = md5( SECRET_KEY | DATA )


can I find

H'' = md5( SECRET_KEY )


where DATA is known and lenght of DATA is known too???

Basically, can I find md5 of the KEY without DATA (once again, DATA is known, H is known, but SECRET_KEY is unknown)?

-
A note: the description of the length-extension attacks omits restrictions on how DATA' must start. – fgrieu Sep 19 '12 at 9:39
Perhaps one might call such an attack a "length-contraction attack"? $\:$ – Ricky Demer Sep 19 '12 at 11:47

## 1 Answer

The short answer is: No, there is no known practical attack in the setup given.

But we do not have an argument/proof that there is not one, and we should be less confident in that than we are in HMAC-MD5, for which we have such an argument.

-
It is important to understand that Merkle–Damgård hashes were never designed to resist attacks of this type. Any properties like this that they have are just the result of pure luck. – David Schwartz Feb 13 '13 at 12:52