length-extension-attacks-anti-pattern

A hash length extension attack exploits vulnerable hash functions like MD5, SHA-1, or SHA-256 to append data to a valid hash(secret + message) signature without knowing the secret key, compromising message integrity. Using HMAC prevents this vulnerability.

To prevent hash length extension attacks in API signatures, replace vulnerable hash(secret + message) patterns with HMAC implementations. This Skill identifies misuse of MD5, SHA-1, and SHA-256, guiding developers to secure HMAC alternatives.

Using hash(secret + message) for message authentication codes creates a vulnerability because attackers can exploit the hash construction to extend the message and forge valid signatures. HMAC securely wraps the hash function to prevent length extension attacks.

Yes, this Skill provides secure HMAC implementation examples for Python, JavaScript, and Java. These cross-language examples help developers replace vulnerable MD5, SHA-1, and SHA-256 hash constructions with secure message authentication alternatives.

This Skill detects MD5, SHA-1, and SHA-256 misuse in message authentication contexts by identifying vulnerable hash(secret + message) patterns. It flags these anti-patterns as CWE-328 vulnerabilities and recommends secure HMAC implementations.

HMAC is resistant to length extension attacks when implemented correctly, but developers must ensure proper key management and use cryptographically sound hash functions. This Skill helps identify vulnerable patterns but secure implementation requires following provided HMAC examples carefully.