Forge the admin cookie — without the secret key

A server signs data as H(secret || data). You've intercepted one message (the secret is never sent). Can you extend it into something the server never signed — and still pass the MAC check — without ever learning the secret?

The intercepted message (this is all an attacker ever sees on the wire):

Your guess for the secret's length (bytes) — real attackers brute-force a small range, or the length is a known system constant

Bytes you want to append to the message

What you compute (never touching the secret):

Forged cookie you'd send back

Verifier A — `H(secret || data)`

mac = toyhash(secret + data)

Verifier B — `H(secret || H(data))`

mac = toyhash(secret + toyhash(data))

Forge the admin cookie — without the secret key

Verifier A — H(secret || data)

Verifier B — H(secret || H(data))

Verifier A — `H(secret || data)`

Verifier B — `H(secret || H(data))`