> I think this is catastrophically broken because of a known issue of how SHA-2 breaks its input into blocks: when A is aligned to a block boundary, sha(A || B) = f(sha(A), g(B)).
If that's the case, wouldn't it suffice to mix A and B, for example with byte-wise XOR?
If that's the case, wouldn't it suffice to mix A and B, for example with byte-wise XOR?