Hacker News Reader

I think the point is that that is not necessarily true for all hash functions, since reordering your example with SHA1 renders it weaker.

If I understood correctly sha1(sha1(secret) + message) is not safe, because from that hash you can calculate sha1(sha1(secret) + message + ANYTHING)

View on HN

Correct; H(H(secret) || message) just scrambles the secret, but doesn't change the MAC construction.

So why not sha1(sha1(secret) + sha1(message))? Or is that essentially an MAC?

One rule of thumb I've discovered: Whenever you say "why not X?", where "X" is some nonstandard construction, the answer is "because X is horribly broken in ways you can't even imagine".

For one thing, you're incurring one more SHA1 invocation than you need; for another, you're clumsily duplicating HMAC, which has other security features (albeit not hugely practical ones). But the core feature of HMAC is indeed hashing the secret separately from the message.

Reply on news.ycombinator.com