MAC Attack Visualizer

← Back to Apps

This interactive visualizer demonstrates a length extension vulnerability on a SHA-1 Message Authentication Code (MAC) where a Keyed-Hash construction MAC = SHA-1(Secret ∥ Message) is improperly implemented.

Note: You do not know this secret key (S). You only need to know (or guess) its bit-length (lk = 128 bits) to correctly calculate the forged length offset.

Step 1: TA Generates MAC1

The TA appends their secret key S to m1 and generates a standard SHA-1 hash. They attach this digest to the message as an authenticating signature.

Original Data Stream Processed by TA (S ∥ m1 ∥ p1):
-

ATTACKER INTERCEPTION: The TA sends m1 and MAC1 to Dr. Ruoti, but you intercept the packet.

Intercepted Message (m1): -
Intercepted Digest (MAC1): -

Step 2: You Extract Intermediate State Vectors

SHA-1 uses a Merkle-Damgård construction. MAC1 is simply the internal state of the hash engine. By breaking it into 5 distinct 32-bit registers, you can initialize your own malicious instance of SHA-1 to resume the hash from where the TA left off.

H0H1H2H3H4
-----

Step 3: You Forge the New Request

You compute the new MAC2 by resuming the SHA-1 engine from the extracted state. You then construct the malicious packet to send to Dr. Ruoti.

Your Malicious Computation (Internal):
-

Packet Sent to Dr. Ruoti:

Forged Message (m'): -
Forged Digest (MAC2): -

Step 4: Dr. Ruoti Authenticates the Forgery

Dr. Ruoti receives the forged packet. He validates it by computing SHA-1(S ∥ m'). Because the construction is length-extendable, he cannot distinguish your forgery from a legitimate message.

Dr. Ruoti's SHA-1(S ∥ m'): -

Created for UTK COSC483/583 Applied Cryptography.