Secret-suffix MD5 as secure PRF (not MAC) In standard secret-suffix fashion, assume we compute the PRF of some message $m$ as $MD5(x || k)$. Preneel and Van Oorschot showed in [1] that this secret-suffix method is unsatisfactory for constructing a secure MAC. (Particularly because MD5 is not collision resistant and therefore the scheme is susceptible to forgeries.) But does that also mean this is not a secure PRF?

[1] http://people.scs.carleton.ca/~paulv/papers/Crypto95.pdf
The collision resistance of MD5 is fully broken, for 2 rounds, or even just 1 round. If follows that we can exhibit distinct 1024-bit or even 512-bit  $x_0$, $x_1$ such that for any $k$, $\operatorname{MD5}(x_0||k)=\operatorname{MD5}(x_1||k)$.

This allows to make a near-perfect distinguisher between the PRF (family) parametrized by $k$: $x\to\operatorname{MD5}(x||k)$, and a random oracle; thus breaking that PRF.