# Difference between HMAC-SHA1(key, msg) vs SHA1(key + msg) [duplicate]

This question already has an answer here:

Is there any practical difference from using HMAC-SHA1(key, msg) vs SHA1(key + msg) as a way to verify the authenticity/integrity of a certain message? Note that the plus sign means string concatenation in this context

Am I losing out on some esoteric detail that the HMAC-SHA1 offers in terms of mathematical immunity to cryptanalysis? Or do both approaches basically do the same thing?

Ive looked through the basic descriptions of both algorithms. And although HMAC-SHA1 seems to do some fancy things with padding and other stuff, I fail to understand any importance. To me both HMAC-SHA1(key, msg) & SHA1(key + msg) carry essentially the same strength/resistance against attacks aside from superficial details

How am I wrong, What am I missing?

## marked as duplicate by otus, Community♦Feb 22 '16 at 8:17

• @octus At the risk of sounding like a clown, what exactly does the double pipe || in H(k||x) mean? Its definitely not the "given that" | found in probability notation. And quick google search has yielded nothing – AlanSTACK Feb 22 '16 at 7:33
• While concatenation is the common usage, in crypto || is often used to mean "mapped injectively into a single string". Now, this might be the same thing, but only if the first parameter does not 'overflow' some designated datatype. A lot of (admittedly rather petty) attacks exist based on the fact when concatenating $A||0B = A0||B$ – figlesquidge Feb 23 '16 at 11:17