I'm working on a little exercise to understand the drawbacks of poor library choices and I've been presented with the following scenario.
The HMAC function in python is being used (md5). I know the message being hashed as well as well as the resulting HMAC for this message. The key being used is generated by random.getrandbits(128).
The only thing I can think of is to put the random.getrandbits(128) in some kind of while loop and generate HMACs for the message until I find a match with the given HMAC.
Is there any way I can extract the key being used by the hmac function knowing the message, the function used to generate keys and the message digest, that does not involve brute-force?