I using sha256 after adding a secret enough if the message includes its length?

Question

I've been reading about HMAC protecting from length extension attacks, but if the message already specifies it size, is HMAC adding any advantange to simple hashing after prepending a secret?

As example consider a protocol where the message is

user +
server +                 // to prevent attackers sending the same message to others
timestamp +              // to avoid replay
message_content_size +   // to avoid extension attacks
message_content +
signature

where the signature is sha256(user_secret + everything except the signature).

Is HMAC providing anything more in this case?

In other words if the problem is length extension, isn't just adding length field to the message enough? This way no extension is possible and I don't see how can you compute the correct hash of a modified message without knowing the secret...

Answer 1

It is not a good idea to simply prepend a secret to SHA-256 in this case. In addition to length extension attacks, which don't appear to be a problem with your approach, you need to consider attacks which may occur where the user tries to move bytes from the secret to the message and vice versa.

Even if these are not a concern in your design, it is much better from a protocol design perspective to use a MAC for this purpose. There are security proofs for HMAC that don't apply to your construction, and if your code is subject to audit, it's much easier to simply say, "Oh, we use HMAC-SHA-256" and not to have to explain that you rolled your own design. HMAC also requires less from a cryptographic algorithm, so typically collision attacks against hash functions tend to affect HMAC substantially less.

Even if you were using BLAKE2 or SHA-3, which aren't vulnerable to length-extension attacks, there are specific MAC modes (e.g., KMAC or BLAKE's keyed mode) that are specifically designed to avoid certain types of problems that can occur from just prepending the key to the message and also provide domain separation.