If I know the hash function, it would be relatively straight forward to deduce what state the hash function is in before processing the final "a" without knowin

If I know the hash function, it would be relatively straight forward to deduce what state the hash function is in before processing the final "a" without knowing t. With that state, it would then be a matter of computing the last character of the hash function with the "b" constant. Once I've got that, I can get m knowing only hash(combine(t,"a")), hash(combine(t,"b")), xor(hb,m) but not knowing t. One way to strengthen your approach is the use an approach borrowed from HMAC, which is to compute hash(combine("a",t,"a")) and hash(combine("b",t,"b")) instead. Now it's a harder problem to figure out the state of the hash function, if you'll permit me to extend your combine function. I hope this is clear.