A secret-suffix MAC authenticates a message by hashing the message followed by a shared secret key: MAC(key, message) = H(message || key). Only parties with the key can normally generate or verify the tag. section 7.2
Appending the key prevents the length-extension attack that affects secret-prefix MACs: verification hashes its own key as the final input, so an attacker cannot simply resume hashing from a known digest. The construction still exposes the message to collision attacks. section 7.4
Collision-based forgery
Suppose an attacker constructs distinct messages A and B with H(A) = H(B). After obtaining a valid tag for A, the attacker submits B with that same tag. The verifier computes H(B || key), while the legitimate tag is H(A || key); because the collision was created in the known message portion, the same authentication value can result. This weakness is especially associated with collision-prone hashes such as MD5 and SHA-1, and contributed to the 2024 break of secret-suffix MAC authentication in RADIUS. section 7.4
Use these rules when choosing a MAC construction:
- Do not treat a secret-suffix MAC as a general replacement for a modern MAC merely because it avoids length extension. section 7.4
- Prefer HMAC, which hashes the secret in multiple passes and is described as resisting both length-extension and collision attacks. section 7.6 section 10.1.5
