How can Hashed Value be same in length extension attack?

Question

Let's say we had the following information:

• Secret = "Hello"
• Message = "Attack at Dawn"
• H(s,m) = ABC

Alice is sending a message to Bob but there is a person in the middle, Mallory who intercepts the message.

A ------(s,m)= v ----> Mallory ------ (s',m') = v' ---------> Bob

In order to make sure that the message is untampered v=v'. Here is my question: how can Mallory append to the end of the hashed value yet still have the same hash?

How is it that $H(\text{ABC||"jk don't attack"}) = ABC$? Doesn't the extra char in the string change the entire hashed output?

Answer 1

It is not about having the same hash value. It was about forging a signature.

It was first executed on Flicker API where the signature was;

$$tag = \operatorname{MD5}(\text{secret_key}\mathbin\|\text{known_data}),$$ the $tag$ and $\text{known_data}$ send to server, and the server can verify it with the $\text{secret_key}$.

The attacker can extend this message into

$$tag_2 = \operatorname{MD5}(\text{secret_key}\mathbin\|\text{known_data}\mathbin\| \text{pad1}\mathbin\| \text{appended_data})$$

Now you can send the server $tag_2$ and extended message $$\text{known_data}\mathbin\| \text{pad1}\mathbin\| \text{appended_data}$$

The server will accept it since it was assumed that the key used in the signature will protect against the forgeries, but not. It was known way before the attack.

It can similarly be applied to SHA-1 if it is used as $$tag_x = \operatorname{SHA-1}(\text{secret_key}\mathbin\|\text{known_data})$$ or any hash function that has no resistance to length extension attacks.

To mitigate one either need HMAC or KMAC of SHA3.

If you ask about finding collisions, it is possible in theory, but not in practice.