Take the 2-minute tour ×  This question already has an answer
here:  On Wikipedia it is said that HMAC is basically (without
taking into account padding):  $H(key\ \Vert\ H(key\ \Vert\
message))$  where $\Vert$ denotes concatenation.  I understand
the need to hash twice, but why concatenate the key a second
time in the outter hashing?  Why not simply hash twice, but
without reusing the key, like this:  $H( H(key\ \Vert\
message))$  A bit like Bitcoin's double-SHA, rumored to be done
to prevent length-extension attacks.  share|improve this
question  marked as duplicate by CodesInChaos, fgrieu, rath,
DrLecter, e-sushi Mar 18 at 15:41   silly me: I answered a clear
duplicate. –  fgrieu Mar 18 at 12:40 @fgrieu At least you gained
some points for your efforts. ;) –  e-sushi Mar 18 at 15:42  1
Answer 1  up vote 4 down vote accepted  As pointed in the
question, with common Merkle–Damgård hashes like SHA-256,
$H(key\ \Vert\ message)$ is vulnerable to a length extension
attack, where $H(key\ \Vert\ message\ \Vert\ pad