I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there.
m = SECRET || data || padding` and `api_signature = md5(m)
The server sends
api_signature to the attacker. The attacker now knows:
h = md5(m) = api_signature
- length of
data(Why does he know and why does he have to know?)
Goal of the attacker: append some extra data
How can he do that? He could take
api_signature = h = md5(m) and use it as the Initialization Vector of the hash function and hash the extra data and another padding. This is the idea behind the hash length_extension attack, isn't it?
My question: The
api_signature will change then because it is calculated like:
md5(extra || padding) with the old
api_signature as an initialization vector. How is this valid?
And overall: What does the server expect from a "normal" client when he sends this?