1

HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work.

Is there some other obvious attack?

ithisa
  • 1,101
  • 9
  • 23
  • 1
    See: http://crypto.stackexchange.com/questions/2669/attacks-of-the-mac-construction-mathcalhmk-for-common-hashes-mathcal?rq=1 – mikeazo Mar 04 '14 at 17:31

0 Answers0