This question already has an answer here:
Let's say I have an input
message of "enoughly long" length (I'll got for a 128 bytes long message, but it might be 256 or whatever).
I know the hash
sha1(message || secret) where
|| is byte concatenation.
message is long enough and knowing how
sha1 works, I can tell that the
message will be split into chunks. Each chunk will be hashed, leading to an "internal state machine", reused to hash next chunk, and only the internal state before hashing the first chunk involving the
secret actually matters to the result hash.
So, in theory, this means I could tamper the
message into another thing
message2, and have the same hash result
sha1(message2 || secret) so long I can keep the internal state unchanged.
Is there a way to do so? Is there a way to built a
message2 so that
sha1(message2 || secret) == sha1(message || secret) when I know
message and fully control
message2 (including its length)? If there is, how to do so? It's not a length extension attack, but it feels like the same kind of process could be used, but I can't find it.