This question already has an answer here:

I was given an argument in a conversation today and I don't know how to respond to it:

H( k || m || k ) should be a better choice of MAC than the traditional HMAC. The person's rationale was that: "You don't know where to pick up extending from, and you don't know what to finish extending into. Sure using k twice looks ugly, but HMAC also uses the key twice, except it also hashes twice. This only hashes once and therefor is faster."

I couldn't refute this on the spot and now the more I think about it the more it bothers me. Are they right? I'd imagine that the cryptographers who decided on HMAC had way more experience when they made their decision. But then why?


marked as duplicate by Biv, Squeamish Ossifrage, Luis Casillas, Gilles, e-sushi Jun 12 '18 at 0:34

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.