0
$\begingroup$

It's well established that H(K||M) is vulnerable to length extension attacks for SHA-2 and other hashing algorithms, and instead an HMAC construction should be used. However - why can't H(M||K) be used instead? Will this also be vulnerable to length extension attack in the same way?

$\endgroup$
0

Browse other questions tagged or ask your own question.