# How is HMAC(message,key) more secure than Hash(key1+message+key2)

I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction.

What I don't understand is, how or why is HMAC_SHA256(message,key) safer (in terms of resistant against certain attacks) than SHA256(key1+message+key2), assuming that all key strings are sufficient in length and entropy?

-
HMAC_SHA256(message,key) has a security proof; we do not have a ready-made one for SHA256(key1+message+key2). That's quite an argument. That said, for reasons similar to HMAC_SHA256, SHA256(key1+message+key2) intuitively seems quite strong: there's a key1 initially, making collision hard; then a final key2, further increasing security. However the lack of alignment to block boundary in SHA256(key1+message+key2) makes it quite hard to devise a proof. –  fgrieu Mar 20 '14 at 20:19
@fgrieu : $\:$ (I realize it's been over a year, but) One could consider SHA256(key1+message+padtoblockboundary+key2) instead. $\;\;\;\;$ –  Ricky Demer Apr 6 at 21:03