According to the HMAC specification in RFC2104, an HMAC is computed in the following way:

HMAC(K, text) = H(K XOR opad, H(K XOR ipad, text))

where H is the underlying hash function, , is concatenation and K has the length of one block.

Now I wonder, what is the benefit of applying the hash function twice here, that is, why wouldn't it be defined like this:

HMAC'(K, text) = H(K XOR ipad, text)

Are there attacks, that are possible against HMAC', but not against HMAC?



Browse other questions tagged or ask your own question.