In the book Information Security Principles and Practice, the author explains why HMAC should be used for integrity with a symmetric key with the message, to prevent a MiTM to replace both the message and its MAC.
He explains why it is not secure to prepend the key to the message, with notation h(K, M). I don't understand how the attack works. Here's the paragraph:
Suppose we choose to compute an HMAC as h(K,M). Most cryptographic hashes hash the message in blocks—for MD5, SHA-1, and Tiger, the block size is 512 bits. As a result, if M = {B1, B2), where each Bi is 512 bits, then h(M) = F(F(A, B1), B2) = F(h(B1), B2) (5.2)
for some function F, where A is a fixed initial constant.
For example, in the Tiger hash, the function F consists of the outer rounds illustrated in Figure 5.2, with each Bi corresponding to a 512-bit block of input and A
corresponding to the 192-bit initial value (a,b,c).If Trudy chooses M' so that M' = (M, X), Trudy might be able to use equation (5.2) to find
h(K, M') from h(K, M) without knowing K since, for K, M, and X
of the appropriate size, h(K, M') = h(K, M, X) = F(h(K, M),X), where the function F is known.
The last paragraph is the attack.
I don't understand, how does the attack work? How can Trudy find h(K, M')
from h(K, M)
without knowing K?