A message authentication code (MAC) based on using a hash function with the secret prefix $H(k||m)$ technique goes back to two independent sources according to Tsudik's article on 1992;
- S. Crocker, S. Kent, Private Communication, December 1990.
- J . Galvin, K. McCloghrie, J. Davin, Secure Management of SNMP Networks Proceedings of IFIP Integrated Network Management Symposium, April 1991
The first real attack on the Merkle-Damgard construction is executed on the Flicker API
Tsudik also mentioned the length extension attacks on the same article as;
Another curious property of the secret prefix method is its vulnerability to padding attacks5 (A padding attack is successful when the intruder is able to either prepend or append extraneous data to an authentic message and pass the resulting message off as genuine .)
and footnote 5 on the article is "This vulnerability was discovered by Dave Solo and Steve Kent"
This is not a real reference in the academic sense. When we look at the A. Menezes, P. van Oorschot, and S. Vanstone's book, they wrote this ( referring 2. reference of the Tsudik );
Galvin, McCloghrie, and Davin suggest addressing the message extension problem in the secret suffix method by using a prepended length field (this requires two passes over the message if the length is not known a priori).
I couldn't find the article of Galvin et. al, only the patent application, to see that where they were referring. So;
- What is the original paper of the length extension attack to refer academically?