According to the HMAC specification in RFC2104, an HMAC is computed in the following way:
HMAC(K, text) = H(K XOR opad, H(K XOR ipad, text))
where H is the underlying hash function, , is concatenation and K has the length of one block.
Now I wonder, what is the benefit of applying the hash function twice here, that is, why wouldn't it be defined like this:
HMAC'(K, text) = H(K XOR ipad, text)
Are there attacks, that are possible against HMAC', but not against HMAC?
