In some (purely paper, so far) protocols I've played with, I prepend the key when hashing, but prepend+append seems safe and sounds good. I wouldn't mind, though, if someone could describe the possible hole if you don't do this. Did it assume no length was appended in the last block? -- -Colin