As I understand it the attacker would have to generate both versions of the message. If an attacker could generate a second message with a hash that matches tha

As I understand it the attacker would have to generate both versions of the message. If an attacker could generate a second message with a hash that matches that of an existing message from a third party, that would be a second-preimage attack, not merely a collision attack. Even MD5 is still considered to be second-preimage resistant: http://crypto.stackexchange.com/q/3441/21238 http://crypto.stackexchange.com/q/3441/21238