Given that a valid hash for a specific payload is known, would some C code like this be vulnerable to a length extension attack?

#include <openssl/hmac.h>
unsigned char *calculated_hash = HMAC(EVP_md5(), &key,sizeof(key) - 1, payload, payload_len, NULL, NULL);
    if(memcmp(calculated_hash, received_hash, 16) == 0){
        dprintf(client_fd, "Payload Valid\n");
    } else {
        dprintf(client_fd, "Payload Invalid\n");

HMAC-MD5 is not vulnerable to length-extension attacks, period.

If that's what your code computes, then your code is not vulnerable to length-extension attacks. That said:

  1. Length-extension attacks are a part of the protocol, not an implementation of the protocol. It doesn't matter whether you use OpenSSL or something else to implement the same protocol.

    You should have a concise description of your protocol and generate test vectors, e.g. with Python or Go, to confirm that your C code is computing the cryptography you intend in the protocol. You should also have a clear statement in a design document of what your protocol accomplishes, without reference to the cryptography it uses; and a clear statement in a separate section of the design document of what security goals your protocol aims for.

  2. Your code has another problem: it has a side channel leak that could be exploited to forge messages, because you're comparing secrets with memcmp. In OpenSSL, you should use CRYPTO_memcmp instead.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.