16

it is often said that when using the MD5 algorithm to sign some arbitrary information, the shared secret has to be at the end. Why?

Jukka Suomela
  • 11,500
  • 2
  • 53
  • 116

1 Answers1

16

See "extension attacks" in the Merkle-Damgard construction. This issue arises in the use of hash functions for message authentication.

In short, putting the secret in the beginning allows the attacker, given a message and its hash, to forge any message which has the given message as a prefix. This is a problem for naive codes but is avoided by well-known codes like HMAC.

randomwalker
  • 176
  • 2
  • 7
  • 1
    From what I understand if you break the input stream and the shared key is the beginning of the stream then the first block will almost always get the same hash and so the shared key can be guessed by the use of rainbow attacks, right? – Alexandru Aug 16 '10 at 20:58