# Why is h(m||k) insecure?

Here is the post that explains the failure for doing h(k||m) and I understand it.

But I don't understand how h(m||k) is subjected to collison attack, or birthday attack. Please explain?

-
–  CodesInChaos Dec 17 '12 at 7:37

The birthday attack can be used with every hash function. It's a simple matter of probability (see: birthday problem). However, that only means that a hash function has to generate $2n$ of output to achieve $n$ bits of security.

It's fairly obvious that $H(m||k)$ is collision-resistant provided that $H$ itself is collision-resistant, since $H(m_1||k)=H(m_2||k)$ would imply that $H(x)=H(y)$ for $x=m_1||k$ and $y=m_2||k$.

However, the big advantage of HMAC over $H(m||k)$ is that collision-resistance of the underlying hashing function is not needed. Bellare proves in New Proofs for NMAC and HMAC: Security without Collision-Resistance that HMAC is secure as long as $H$ is a pseudorandom function, which is considerably weaker than collision-resistance.

Thus, even though the once popular hashing functions $MD5$ and $SHA$ are already broken, $HMAC_{MD5}$ and $HMAC_{SHA}$ are stil considered secure.

-
OKay. I read it again. Basically, if the assumption that the hash function is not crypto-safe anymore, then we will see collision at some point. But what about H(K||X). If we use MD5, we not only experience length extension attack, but also collision attack, right? –  CppLearner Dec 17 '12 at 6:17
@CppLearner A collision attack for $H(K||X)$ with secret (short) $K$ would also lead to a collision attack on $HMAC_H(K', X)$ with a similar $K'$ (just $K$ XORed with the ipad constant). For now, there is no known way to do this. –  Paŭlo Ebermann Dec 17 '12 at 8:29