If I know

H = md5( SECRET_KEY | DATA )

then I can calculate

H' = md5( SECRET_KEY | DATA | DATA' )

That's length-extension attack. But is the opposite possible? E.g. if I know

H = md5( SECRET_KEY | DATA )

can I find

H'' = md5( SECRET_KEY )

where DATA is known and lenght of DATA is known too???

Basically, can I find md5 of the KEY without DATA (once again, DATA is known, H is known, but SECRET_KEY is unknown)?

  • $\begingroup$ A note: the description of the length-extension attacks omits restrictions on how DATA' must start. $\endgroup$
    – fgrieu
    Sep 19 '12 at 9:39
  • $\begingroup$ Perhaps one might call such an attack a "length-contraction attack"? $\:$ $\endgroup$
    – user991
    Sep 19 '12 at 11:47

The short answer is: No, there is no known practical attack in the setup given.

But we do not have an argument/proof that there is not one, and we should be less confident in that than we are in HMAC-MD5, for which we have such an argument.

  • 3
    $\begingroup$ It is important to understand that Merkle–Damgård hashes were never designed to resist attacks of this type. Any properties like this that they have are just the result of pure luck. $\endgroup$ Feb 13 '13 at 12:52
  • 1
    $\begingroup$ It would mean we can invert $h \mapsto E_m(h) + h$ where $E$ is the block cipher out of which MD5's compression function is built. This seems unlikely without serious cryptanalytic damage to $E$ (and it would presumably not have a unique answer most of the time). $\endgroup$ Mar 10 '19 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.