> I think the OP point still stands, just use HMAC instead of inventing crypto schemes.

Completely valid point, I was asking purely out of curiosity since this isn't my area of expertise but I find these kinds of vulnerabilities intriguing.