# Why is appending the key to a mesage and then hashing that insecure if the hash isn't weakly collision resistant? [duplicate]

Suppose I have H(M|K) and that H is not weakly collision resistant. If I have a message mac pair (M,MAC), how is it possible to find another message mac pair (M2,MAC2)? My thinking for this problem is that if the hash isn't weakly collision resistant, then I can find another message M2 such that H(M|K)=H(M2|K) and thus, I have a new pair (M2,MAC2). Is this a sufficient explanation for explaining why H(M|K) is insecure if the underlying hash function is weak?

• crypto.stackexchange.com/questions/1070/… for $H(k||m)$ might also be of interest. – archie Nov 11 '13 at 20:49
• Yes, I am indeed asking the same thing. However, I just wanted to make sure I'm correct in my understanding of what is mentioned there. – user979616 Nov 12 '13 at 2:01

Note: If $M_i$ are hash function's input blocks and $S_i$ are successive states most hash functions do just $S_i=F(S_{i-1},M_i)$, and the hash result is the last state, making length extension and collision attacks possible.