# Homework/Project 1
**Student information:** Owen Sullivan (opsulli | C34243277)

## Introduction
For this assignment, I worked alone and thus did not divide up any of the work.

## Methodology

### Length Extension Attack
For the SHA-256 length extension attack (found in `len_ext_attack.py`), I began by finding a valid token hash from [http://cpsc4200.mpese.com/opsulli/lengthextension/api?token=...&command=SprinklersPowerOn](http://cpsc4200.mpese.com/opsulli/lengthextension/api?token=ee954d48c281aa15c6bef23e865dffed9b4349ad7bf45c9f5ac6f8c0750dbbce&command=SprinklersPowerOn).

Then, I initialized a new `sha256` object by setting the initial `state` to the extracted valid token hash and the `count` to the original message length (`8` + the length of the valid command sequence, where `8` is the number of bytes in the secret password).

After updating/appending the malicious command string, a new hash is generated and can be injected into a valid URL by replacing the existing token and appending both the required padding for the original message and the malicious command string to the end of the URL. This results in a valid URL to perform both the legitimate and malicious commands.

### Hash Collisions
For the MD5 collision attack (which generated `good.py` and `evil.py`), I began by generating a pair of collisions using `fastcoll -p prefix -o good evil`. Then, I used the example suffix file which prints the SHA-256 hash of the blob generated by `fastcoll`.

Because those hashes are different, despite the MD5 hashes being the same, I used them to build a new suffix file which contains a Python if/else statement that checks to see whether the SHA-256 hash of the blob contained within the program matches either of the expected blob hashes.

Finally, the new suffix was added to generate `good.py` and `evil.py`, which both print different output depending on the blob contained within. This approach is superior to an if/else statement checking the file name because the if branches would fail to execute properly if the file names were changed prior to running the program.