I think you lost everyone here :D
If length extension attacks are a problem, you're using a hash function for something which a hash function is not intended to be used for; you probably wanted a MAC instead.
1. Yes. And people do that. I'm nkt talking about me. I'm talking about things I see in my work (I'm a consultant).
2. People should be able to do that. If you're expecting your hash function to behave somehow like a random oracle there is no reason that h(key|data) doesn't work. I see people using sha-2 to derive keys all the time. Even this is unsafe depending on how you do it.
Why must MAC mean "HMAC RFC2104?"
It doesn't. I said MAC, not HMAC.
Re:Maybe Skip SHA-3
by krakensden on Wednesday May 31, 2017 @11:35PM
(#14457812)
Hash functions have a pigeonhole principle problem, but that is also the point.
SHA2 is vulnerable to length extension attacks the same way as bread is vulnerable to being buttered. If you're using bread and you're worried about buttering, you fundamentally misunderstand what bread is.