I've been studying the MD5 hashing algorithm, and there is something that I just don't understand yet. They say that the server holds some sort or "secret" and that it appends some sort of "message" (or "data") to that secret. Then, the algorithm adds the appropriate padding to the concatenated ("secret" + "data") and the process continues from there. Now, it is said that only the server knows the "secret", but an attacker would know the "data" as well as the signature (which is apparently the result that comes out of hashing ("secret + data")). Now, here is what I don't get:
Let's say we have a URL:
Now, the ABCDEFGHIJKLMNOP part is the hashed part of this URL. Would it be correct to call that part the signature? If so, what exactly is the "data" that an attacker supposedly knows? Where in this URL is the "data" that was appended to the "secret"?
Also, why is "data" appended to the "secret" in the first place? Why isn't the "secret" just hashed by itself and kept hidden from an attacker instead of giving the attacker some apparently known "data"?