I don't know if you've seen it, but I outlined the attacks against H(msg || secret), aka "secret suffix", here: http://rdist.root.org/2009/10/29/stop-using-uns

I don't know if you've seen it, but I outlined the attacks against H(msg || secret), aka "secret suffix", here: http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-hashes-use-hmac/ http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-has... In particular, there are simple attacks when it is used with a hash function that has effective collision attacks, such as MD5.