Why you should never use hash functions for message authentication

Read the linked article together with this reply Show archive.org snapshot to get an appreciation for why it's a bad idea to roll your own crypto protocol.