# Is $H(k \operatorname\| H(k \operatorname\| m))$​ with double length $k$ like NMAC? [duplicate]

This question already has an answer here:

I know that NMAC is mathematically proved with two different keys with length $L$.

But, if I choose to implement a MAC this way: $$H(k \operatorname\| H(k \operatorname\| msg))$$ with a key $k$ of length ​$2L$, ​am I vulnerable to some attacks?

## marked as duplicate by Squeamish Ossifrage, AleksanderRas, kelalaka, Maarten Bodewes♦Jun 23 at 8:43

• Length-extension attacks don't apply here, given that the outer layer has constant input length. This construction is equivalent to the $\text{NMAC}_3$ construction studied in eprint.iacr.org/2011/649. Its exact security is unknown. – Samuel Neves Dec 6 '16 at 19:14