In Another look at HMAC from Koblitz and Menezes, they state that HMAC came along because doing h(secret || message) was vulnerable to length extension attacks. But as far as I know, these kind of attacks only exist because of the Merkle-Damgard construction.
Now that we have SHA-3, that does not use such a construction, and that is not vulnerable to length extension attacks. Do we need to use the complicated HMAC-SHA3 or can we just use SHA3 as a MAC?
