MD5 „under“-signed

Avatar von Johann-Peter Hartmann

In one of my softwares i have to prove that the xml output given is authentic.
So i simply take secret known by my counterpart and me, add it to the xml string and use a md5 to sign the xml stuff. No more.

Take a look at this:
and this, if you are not already bored:

It is possible to create "doppelganger" blocks in documents or binaries that don’t change the md5 of it. So my opponent simply takes my xml, changes the main information and still has the proof that i am the one to blame.

So good bye md5, it was a nice time we had, but somehow my life went further and you don’t fit in any more. Just a short time-out. Let’s see us two as – eh – friends. No, the other hash (sha1, that is) i am living with now has nothing to do with it. It’s just the feeling that i can’t trust you anymore.

PS: PHP supports sha1 since 4.3, MySQL does not until now, but that should be easy (hartmut? weigon? ulf? anyone? ;-)

Avatar von Johann-Peter Hartmann


2 Antworten zu „MD5 „under“-signed“

  1. It seems to me like you want to implement HMAC.

    „Hashed Message Authentication Code, using keyed message digest functions to authenticate a message.“

    HMAC is defined in RFC 2104 [1]

    There is a PEAR package called Crypt_HMAC[2] and another called Message [3] which both deal with this that I suggest you take a look at!


  2. P.S.

    Your comments need to recognise linebreaks ;)

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

Für das Handling unseres Newsletters nutzen wir den Dienst HubSpot. Mehr Informationen, insbesondere auch zu Deinem Widerrufsrecht, kannst Du jederzeit unserer Datenschutzerklärung entnehmen.