I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). And it works, I know the length of the key, so I'm able to get the total length of the message and forge a hash. However, when I try to brute force the length of the key (as it should be unknown), I always end up getting the same hashes for groups of 64 lengths, and not different ones for each. This makes sense for me, as I am padding the (original message + key) and so the length of the padded message should be the same for a certain number of key sizes, right? Does this imply that it is impossible to retrieve the key length? I think there is something wrong in my reasoning... Here is the code that I'm using:
for i in range(0, 200):
specificLength = len(padSHA1(i * "a" + originalMsg) + "extension")
forged = sha1ExtensionAttack("extension", registers, specificLength)
print i, forged, payloadSHA, specificLength
if forged == payloadSHA:
print i, len(key)
assert len(key) == i
print "[*] Length of key is {}".format(i)
break
When I run it with a key length of 49 I end up getting a success with a length of 43, which doesn't make much sense. Then, I get the same hash for lengths 43 to 107...
I'll be very grateful if anyone explains to me what's wrong with this approach, thank you!