Wikipedia lists the following pseudocode for HMAC:
function hmac (key, message) if (length(key) > blocksize) then key = hash(key) // keys longer than blocksize are shortened end if if (length(key) < blocksize) then // keys shorter than blocksize are zero-padded ('∥' is concatenation) key = key ∥ [0x00 * (blocksize - length(key))] end if // Where blocksize is that of the underlying hash function o_key_pad = [0x5c * blocksize] ⊕ key // Where ⊕ is exclusive or (XOR) i_key_pad = [0x36 * blocksize] ⊕ key // Where '∥' is concatenation return hash(o_key_pad ∥ hash(i_key_pad ∥ message)) end function
Why are they there? How were they chosen?
It seems to me that $hash(key + hash(message))$ (where + is concatenation) would suffice.
Obviously I'm missing something. What is it?