I read about Hash Length Extension attacks here and here. From the articles I gained that this attack relies on the data structure, in the way that the secret has to be prefixed to the data (please correct me if I'm wrong). If that was the case, would it be a reasonable defense mechanism against this kind of attack to simply move the secret in the data structure?

From the article:

let secret = "secret"
let data = "data"
let H = md5()
let signature = hash(secret || data)

Would this (i.e. moving the secret to the middle of the signature):

let signature = hash( string.Format( "{0}{1}{2}", data.Substring( 0, ( int ) ( data.Length / 2 ) ), secret, data.Substring( ( int ) ( data.Length / 2 ) ) ) );

be safe?

  • you can just swap the order of input to data || secret or use a sponge-based hash. hash(secret || hash(secret || data)) would also work. – dandavis Sep 7 '17 at 19:05
  • 1
    This attack still applies. ​ ​ – user49075 Sep 7 '17 at 19:22

Let formalize the secret in the middle as;

signature = Hash( m[1..l/2] || secret || m[l/2+1..l] )

where l = len(m). This construction is not differ from the original H(k,m) since simply consider that k = m[1..l/2] || secret and then apply the length extension attack, success!

The attack append-only attack H(m,k) - linked by user49075 on the comments - described in section 6 of the HMAC paper, "Keying hash functions for message authentication" by Bellare, Canetti, and Krawczyk only works if

  1. The hash function is not collision-resistant, and
  2. The collision pairs have the same length.

Of course, once the hash function is turned into non-collision resistant like MD5 and SHA-1, it might be easy to find files that have the same length.

The good point is that HMAC doesn't require the underlying hash function to be collision-resistant.

So you can use HMAC-SHA1 even though SHA-1 has lost its collision resistance.

The construction of the HMAC is complex due to the Merkle-Damgard construction. With the SHA-3, due to it's resistance to length extension attack, one can use KMAC

Similarly, one can use Blake2(K||m) safely since Blake2's design is based on the HAIFA constitution and that can be easily turned into length extension attack resistant hash function as in Blake2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.