MD5 „under“-signed

Avatar von Johann-Peter Hartmann

In one of my softwares i have to prove that the xml output given is authentic.
So i simply take secret known by my counterpart and me, add it to the xml string and use a md5 to sign the xml stuff. No more.


Take a look at this:
http://diswww.mit.edu/menelaus.mit.edu/bt/37630
and this, if you are not already bored:
http://www.doxpara.com/md5_someday.pdf

It is possible to create "doppelganger" blocks in documents or binaries that don’t change the md5 of it. So my opponent simply takes my xml, changes the main information and still has the proof that i am the one to blame.

So good bye md5, it was a nice time we had, but somehow my life went further and you don’t fit in any more. Just a short time-out. Let’s see us two as – eh – friends. No, the other hash (sha1, that is) i am living with now has nothing to do with it. It’s just the feeling that i can’t trust you anymore.

PS: PHP supports sha1 since 4.3, MySQL does not until now, but that should be easy (hartmut? weigon? ulf? anyone? ;-)

In eigener Sache …

Mit WebAssembly die Kosten für die Wartung Deiner Cloud-Anwendung sparen und die Wirtschaftlichkeit und Effizienz des Unternehmens steigern?

Am 26. September 2024 um 11:30 Uhr bieten Dir unsere Experten einen tiefen Einblick in ein spannendes R&D-Projekt.

Melde Dich jetzt kostenlos an!

Avatar von Johann-Peter Hartmann

Kommentare

2 Antworten zu „MD5 „under“-signed“

  1. It seems to me like you want to implement HMAC.

    „Hashed Message Authentication Code, using keyed message digest functions to authenticate a message.“

    HMAC is defined in RFC 2104 [1]

    There is a PEAR package called Crypt_HMAC[2] and another called Message [3] which both deal with this that I suggest you take a look at!

    [1] http://www.faqs.org/rfcs/rfc2104.html
    [2] http://pear.php.net/Crypt_HMAC
    [3] http://pear.php.net/Message

  2. P.S.

    Your comments need to recognise linebreaks ;)

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert


Für das Handling unseres Newsletters nutzen wir den Dienst HubSpot. Mehr Informationen, insbesondere auch zu Deinem Widerrufsrecht, kannst Du jederzeit unserer Datenschutzerklärung entnehmen.