RFC 2104 specifies how you should do it, see e.g. http://de.wikipedia.org/wiki/Keyed-Hash_Message_Authentication_Code http://de.wikipedia.org/wiki/Keyed-Hash_Me

RFC 2104 specifies how you should do it, see e.g. http://de.wikipedia.org/wiki/Keyed-Hash_Message_Authentication_Code http://de.wikipedia.org/wiki/Keyed-Hash_Message_Authenticati... The Handbook of Applied Cryptography, Chapter 9 (free online: http://cacr.uwaterloo.ca/hac/ http://cacr.uwaterloo.ca/hac/) nicely explains the reasons.