Wikipedia lists the following pseudocode for HMAC:
function hmac (key, message)
if (length(key) > blocksize) then
key = hash(key) // keys longer than blocksize are shortened
end if
if (length(key) < blocksize) then
// keys shorter than blocksize are zero-padded ('∥' is concatenation)
key = key ∥ [0x00 * (blocksize - length(key))]
end if
// Where blocksize is that of the underlying hash function
o_key_pad = [0x5c * blocksize] ⊕ key
// Where ⊕ is exclusive or (XOR)
i_key_pad = [0x36 * blocksize] ⊕ key
// Where '∥' is concatenation
return hash(o_key_pad ∥ hash(i_key_pad ∥ message))
end function
Why are they there? How were they chosen?
It seems to me that $hash(key + hash(message))$ (where + is concatenation) would suffice.
Obviously I'm missing something. What is it?