Tag Info

The short answer is no. I'll assume $SHA256_d(M)$ is $SHA256(M)$ when $d=0$, else $SHA256(SHA256_{d-1}(M))$. $SHA256_1$ is protected against length extension attacks. The only sizable benefit that I see in parameterizing $d$ is that it allows tuning a slow down of the computation intended as a protection against brute force attacks. However there are more ...

You're missing the most important strength of HMAC: it comes with a proof of security (under some plausible assumptions). The outer key plays an important role in the proofs. The best place to learn more is to read the HMAC papers: Message authentication using hash functions: The HMAC construction, Mihir Bellare, Ran Canetti, Hugo Kawczyk, CryptoBytes ...

As a Skein co-author, one of the properties of the UBI chaining mode is to give you HMAC-like properties in one pass. Skein itself consists of the Threefish tweakable block cipher, the UBI chaining mode, and some proofs that extend tweakable block cipher theory into a tweakable hash function theory that reduces the security of the hash function to the ...

The archetypal situation where the length-extension property becomes problematic is when ones builds a Message Authentication Code from a hash function as $$BadMAC(K,M)=Hash(K||M)$$ where $K||M$ is the concatenation of the Key and the Message. The length extension property then translates directly into the capability to forge a different message, starting ...

AFAIK the d stands for double, and simply means that the input gets hashed twice. i.e. SHA-256d = SHA-256(SHA-256(m)). It's not a configurable parameter, since hashing more often has no benefit, unless you want a slow down, but there are better constructions for that case. Hashing twice prevents length-extension attacks, but reduces performance, especially ...

I'm putting another answer in because as good as D.W.'s answer is (I up-voted it), it doesn't really answer your question. You said: But the simple construction Hash(Hash(key|message)) would offer those properties too. But the construction you gave -- Hash(Hash(key|message)) -- has a weakness that HMAC does not. One of those properties was ...