[bawolff]

> "In short: constructions that concatenate secrets are vulnerable when the underlying hash function is not collision-resistant"

That's quite a condition.