I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there.
m = SECRET || data || padding` and `api_signature = md5(m)
The server sends data
and api_signature
to the attacker. The attacker now knows:
h = md5(m) = api_signature
data
- length of
data
(Why does he know and why does he have to know?)
Goal of the attacker: append some extra data
How can he do that? He could take api_signature = h = md5(m)
and use it as the Initialization Vector of the hash function and hash the extra data and another padding. This is the idea behind the hash length_extension attack, isn't it?
My question: The api_signature
will change then because it is calculated like: md5(extra || padding)
with the old api_signature
as an initialization vector. How is this valid?
And overall: What does the server expect from a "normal" client when he sends this?