Tag protecting against extension-based attacks