python hex hmac md5 of passwords not matching javascript

Question

i have a javascript password coder md5 = hex_hmac_md5(secret, password) How can i emulate this in python - ive tried md5 but that is not the same value i got my md5 javascript code from this website: Pajs Home (md5.js) He states the use is as follows: In many uses of hashes you end up wanting to combine a key with some data. It isn't so bad to do this by simple concatenation, but HMAC is specifically designed for this use. The usage is: hash = hex_hmac_md5("key", "data"); The HMAC result is also available base-64 encoded or as a binary string, using b64_hmac_* or str_hmac_*. Some other hash libraries have the arguments the other way round. If the JavaScript HMAC doesn't match the value your server library generates, try swapping the order. I have tried some python like this: ``` > def md5_test(secret, password): > > return md5(secret+password).hexdigest() ``` Can anyone tell me what the code should be in python to get the same value? Thanks

Accepted Answer

That's what Python's `hmac` module is for, don't use the MD5 function directly.

```
# Right
import hmac
# Note that hmac.new defaults to using MD5
hmac.new("password", "message").hexdigest() # 'f37438341e3d22aa11b4b2e838120dcf'

# Wrong
from hashlib import md5
md5("message"+"password").hexdigest() # 'd0647ee3be62a57c9475541c378b1fac'
md5("password"+"message").hexdigest() # 'c494404d2dd827b05e27bd1f30a763d2'
```

Also take a look at how HMAC is implemented (e.g. on Wikipedia).

python hex hmac md5 of passwords not matching javascript

Solution

Problem