6
$\begingroup$

If I know

H = md5( SECRET_KEY | DATA )

then I can calculate

H' = md5( SECRET_KEY | DATA | DATA' )

That's length-extension attack. But is the opposite possible? E.g. if I know

H = md5( SECRET_KEY | DATA )

can I find

H'' = md5( SECRET_KEY )

where DATA is known and lenght of DATA is known too???

Basically, can I find md5 of the KEY without DATA (once again, DATA is known, H is known, but SECRET_KEY is unknown)?

Improve this question
$\endgroup$
2
  • $\begingroup$ A note: the description of the length-extension attacks omits restrictions on how DATA' must start. $\endgroup$
    – fgrieu ♦
    Commented Sep 19, 2012 at 9:39
  • $\begingroup$ Perhaps one might call such an attack a "length-contraction attack"? $\:$ $\endgroup$
    – user991
    Commented Sep 19, 2012 at 11:47

1 Answer 1

Reset to default
3
$\begingroup$

The short answer is: No, there is no known practical attack in the setup given.

But we do not have an argument/proof that there is not one, and we should be less confident in that than we are in HMAC-MD5, for which we have such an argument.

Improve this answer
$\endgroup$
2
  • 3
    $\begingroup$ It is important to understand that Merkle–Damgård hashes were never designed to resist attacks of this type. Any properties like this that they have are just the result of pure luck. $\endgroup$
    – David Schwartz
    Commented Feb 13, 2013 at 12:52
  • 1
    $\begingroup$ It would mean we can invert $h \mapsto E_m(h) + h$ where $E$ is the block cipher out of which MD5's compression function is built. This seems unlikely without serious cryptanalytic damage to $E$ (and it would presumably not have a unique answer most of the time). $\endgroup$
    – Squeamish Ossifrage
    Commented Mar 10, 2019 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.