Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following:
T = text, which is directly viewable as plain text in a HTTP header.
AppId, AccessKey = ID and Key pairs authorized from server. The ID is also appended as plain text in HTTP header.
signature = MD5(T || timestamp || AppId || AccessKey)
My question is how secure is this signature design? I've searched for many sorts of collision attacks, and the closest one to this condition is the chosen prefix attack, which seems still hard to effectively exploit this signature.
Any idea would be greatly appreciated.