# md5: is reverse length-extension attack possible?

If I know

H = md5( SECRET_KEY | DATA )


then I can calculate

H' = md5( SECRET_KEY | DATA | DATA' )


That's length-extension attack. But is the opposite possible? E.g. if I know

H = md5( SECRET_KEY | DATA )


can I find

H'' = md5( SECRET_KEY )


where DATA is known and lenght of DATA is known too???

Basically, can I find md5 of the KEY without DATA (once again, DATA is known, H is known, but SECRET_KEY is unknown)?

• A note: the description of the length-extension attacks omits restrictions on how DATA' must start. – fgrieu Sep 19 '12 at 9:39
• Perhaps one might call such an attack a "length-contraction attack"? $\:$ – user991 Sep 19 '12 at 11:47

• It would mean we can invert $h \mapsto E_m(h) + h$ where $E$ is the block cipher out of which MD5's compression function is built. This seems unlikely without serious cryptanalytic damage to $E$ (and it would presumably not have a unique answer most of the time). – Squeamish Ossifrage Mar 10 '19 at 21:51