Question

i have a javascript password coder

md5 = hex_hmac_md5(secret, password)

How can i emulate this in python – ive tried md5 but that is not the same value

i got my md5 javascript code from this website:

Pajs Home

(md5.js)

He states the use is as follows:

In many uses of hashes you end up
wanting to combine a key with some
data. It isn’t so bad to do this by
simple concatenation, but HMAC is
specifically designed for this use.
The usage is:

hash = hex_hmac_md5(“key”, “data”);

The HMAC result is also available
base-64 encoded or as a binary string,
using b64_hmac_* or str_hmac_*.

Some other hash libraries have the
arguments the other way round. If the
JavaScript HMAC doesn’t match the
value your server library generates,
try swapping the order.

I have tried some python like this:

> def md5_test(secret, password):
>     
>     return md5(secret+password).hexdigest()

Can anyone tell me what the code should be in python to get the same value?

Thanks

Answer 1

That’s what Python’s hmac module is for, don’t use the MD5 function directly.

# Right
import hmac
# Note that hmac.new defaults to using MD5
hmac.new("password", "message").hexdigest() # 'f37438341e3d22aa11b4b2e838120dcf'

# Wrong
from hashlib import md5
md5("message"+"password").hexdigest() # 'd0647ee3be62a57c9475541c378b1fac'
md5("password"+"message").hexdigest() # 'c494404d2dd827b05e27bd1f30a763d2'

Also take a look at how HMAC is implemented (e.g. on Wikipedia).