<p>See "extension attacks" in the <a href="http://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd_construction" rel="noreferrer">Merkle-Damgard construction</a>. This issue arises in the use of hash functions for <a href="http://en.wikipedia.org/wiki/Message_authentication_code" rel="noreferrer">message authentication</a>.</p>

<p>In short, putting the secret in the beginning allows the attacker, given a message and its hash, to forge any message which has the given message as a prefix. This is a problem for naive codes but is avoided by well-known codes like <a href="http://en.wikipedia.org/wiki/HMAC" rel="noreferrer">HMAC</a>.</p>

CC BY-SA 2.5
2010-08-16T20:58:20.320Z
From what I understand if you break the input stream and the shared key is the beginning of the stream then the first block will almost always get the same hash and so the shared key can be guessed by the use of rainbow attacks, right?
Alexandru
CC BY-SA 2.5
2010-08-16T20:53:02.767Z
2010-08-16T20:53:02.767Z
randomwalker
<p>it is often said that when using the MD5 algorithm to sign some arbitrary information, the shared secret has to be at the end. Why?</p>

CC BY-SA 2.5
2010-08-16T20:38:24.377Z
Can you please be more specific instead of saying 'often said'. Can you cite references, and also expand on why the issue is relevant ?
Suresh Venkat
CC BY-SA 2.5
2010-08-16T21:54:50.487Z
There's a typo in your question title: can you change "and" to "end"?
Carlos Scheidegger
<hash-function><cr.crypto-security>
Why is it important that the secret is at the end when signing with MD5?
Hendrik Brummermann
# Why is it important that the secret is at the end when signing with MD5?

(Asked by: username_0 on 2010-08-16)

it is often said that when using the MD5 algorithm to sign some arbitrary information, the shared secret has to be at the end. Why?

**Tags:** hash-function, cr.crypto-security

> **Comments:**
> **username_1**: Can you please be more specific instead of saying 'often said'. Can you cite references, and also expand on why the issue is relevant ?  
> **username_2**: There's a typo in your question title: can you change "and" to "end"?  

---

## 1 answers

### Answer by username_3 on 2010-08-16. Score: 16 | Accepted answer

See "extension attacks" in the [Merkle-Damgard construction](http://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd_construction). This issue arises in the use of hash functions for [message authentication](http://en.wikipedia.org/wiki/Message_authentication_code).

In short, putting the secret in the beginning allows the attacker, given a message and its hash, to forge any message which has the given message as a prefix. This is a problem for naive codes but is avoided by well-known codes like [HMAC](http://en.wikipedia.org/wiki/HMAC).

> **Comments:**
> **username_4**: From what I understand if you break the input stream and the shared key is the beginning of the stream then the first block will almost always get the same hash and so the shared key can be guessed by the use of rainbow attacks, right?  

---

