python hex hmac md5 of passwords not matching javascript

Question

hi all

i have a javascript password coder

md5 = hex_hmac_md5(secret, password)

How can i emulate this in python - ive tried md5 but that is not the same value

i got my md5 javascript code from this website:

Pajs Home

(md5.js)

He states the use is as follows:

In many uses of hashes you end up wanting to combine a key with some data. It isn't so bad to do this by simple concatenation, but HMAC is specifically designed for this use. The usage is:

hash = hex_hmac_md5("key", "data");

The HMAC result is also available base-64 encoded or as a binary string, using b64_hmac_* or str_hmac_*.

Some other hash libraries have the arguments the other way round. If the JavaScript HMAC doesn't match the value your server library generates, try swapping the order.

I have tried some python like this:

> def md5_test(secret, password):
>     
>     return md5(secret+password).hexdigest()

Can anyone tell me what the code should be in python to get the same value?

Thanks

Answer 1

That's what Python's hmac module is for, don't use the MD5 function directly.

# Right
import hmac
# Note that hmac.new defaults to using MD5
hmac.new("password", "message").hexdigest() # 'f37438341e3d22aa11b4b2e838120dcf'

# Wrong
from hashlib import md5
md5("message"+"password").hexdigest() # 'd0647ee3be62a57c9475541c378b1fac'
md5("password"+"message").hexdigest() # 'c494404d2dd827b05e27bd1f30a763d2'

Also take a look at how HMAC is implemented (e.g. on Wikipedia).