Exercise 1: Why a Plain Hash Provides No Real Protection — Possible Solution
====================================================================

Step by step:

1. A sender transmits a message plus its plain SHA-256 hash, intending
   the hash as an integrity check.

2. An attacker intercepts the message in transit and freely modifies
   its contents in any way they like.

3. To produce a matching hash for the tampered message, the attacker
   simply runs SHA-256 on their new, tampered version. This step
   requires NO SECRET KNOWLEDGE at all -- SHA-256 is a public
   algorithm (Chapter 1's Kerckhoffs's Principle) that anyone, sender
   or attacker, can run identically.

4. The attacker forwards the tampered message together with this
   freshly, correctly computed hash.

5. The receiver checks: does the received hash match a fresh SHA-256
   computation of the received message? Yes -- because the attacker
   computed exactly that hash for exactly that (tampered) message.
   The check passes, and the tampered message is accepted as if it
   were untouched.

The hash was never technically "wrong" at any point -- it correctly
described the tampered message it was actually given. The entire
scheme fails not because the hash function is broken, but because
NOTHING in the scheme required the attacker to possess any secret in
order to produce a valid-looking hash for whatever content they chose.

What a MAC adds:

A MAC replaces plain hashing with MAC(key, message), where a secret
key known only to the legitimate sender and receiver is mixed into the
computation. Now step 3 above is impossible for the attacker to
replicate: without the key, they cannot compute a MAC that will match
what the receiver (who DOES hold the key) recomputes for the tampered
message. Tampering is now detectable, because producing a valid
authentication value for arbitrary content requires something the
attacker doesn't have.

WHY THIS WORKS AS AN ANSWER
------------------------------
This traces the chapter's own numbered attack sequence exactly,
making explicit the one detail that makes it work: "recomputing a
hash requires no secret at all." The MAC comparison at the end
directly states the chapter's own core distinction -- a MAC's entire
value comes from requiring a secret that a hash, by design, never
needed.