[CFRG] Reference for weakness in MAC=hash(key|msg) construct

[Robert Moskowitz <[e-mail]>]

I need to show that a MAC based on hash(key|msg) is bad and this has 
been known since the mid-90s.

This is for the Drone Command and Control (C2) open protocol MAVlink's 6 
byte authentication:

https://mavlink.io/en/guide/message_signing.html

I am familiar with "Keying hash functions for message authentication 
(1996)" by Mihir Bellare , Ran Canetti , Hugo Krawczyk, but it does not 
clearly show the weakness of hash (key|msg). 
(https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.134.8430)

I attended Hugo's presentations of HMAC and SIGMA at the ISOC Security 
Conference in '96 and have been using them since.  But now I encounter, 
and have to deal with what I believe is a flawed design.  I need to show 
references that this was known flawed for 20 years prior to MAVlink 2.0 
(that added the auth).

Well, anyway, what I learned 25 years ago set my mind that 
MAC=hash(key|msg) construct is flawed.  Details tend to get hazy over time.

Note that MAVlink may be transported over UDP on port 14550.  By using 
RFC8750 (and a 12-byte ICV for GCM) and draft-mglt-ipsecme-diet-esp I 
can have ESP/AES-GCM-12/UDP in 16 bytes.  Compress the MAVlink Seq, 
Checksum, and Sig out, replacing them with this design in the same 
length (and include the 8 byte UDP cost).

So anyway, the basic need is a reference on the weakness of 
MAC=hash(key|msg) construct

thanks.