# School exercise on untrusted channel comunication [duplicate]

Possible Duplicate:
Why is H(k||x) not a secure MAC construction?

I've the following problem: two parties, A and B, share a secret key Kab. M is a plaintext message, H an unkeyed hash function

A send to B M, H( Kab | M ) (where | means concatenation).

If we want to provide data origin authentication and data integrity (no confidentiality required) my exercise states that we have to change the protocol to this:

A send to B M, H( Kab | M | Kab ).

I don't understand the difference in term of guarantees of the two protocols and thereby, why the second one is 'right' and the first one is not?

## marked as duplicate by CodesInChaos, mikeazoJan 28 '13 at 19:18

• Note that the exercise assumes that the hash in question is a Merkle-Damgaard hash without truncation; if the hash was (say) SHA-3 or SHA-2-384, $H( Kab | M)$ does appear to be sufficient. – poncho Jan 28 '13 at 16:35