It's well known that using a hash function as message authentication is vulnerable to length extension attacks.
ie. H(key+message) is a bad idea. H(message+key), H(key+message+key) have their issues as well.
However, what if valid messages are a known length? Does length extension still apply?