问什么是双HMAC验证以及它是如何工作的？

EN

public void validateHMACSHA256(byte[]receivedHMAC, byte[]message, byte[]key) {
    HashAlgorithm hashAlgorithm = new HMACSHA256(key);

    // size and algorithm choice are not secret; no weakness in failing fast here.
    if (receivedHMAC.Length != hashAlgorithm.HashSize / 8) {
        Throw new CryptographicException("HMAC verification failure.");
    }
    byte[]calculatedHMAC = hashAlgorithm.ComputeHash(message);
    // Now we HMAC both values again before comparing to randomize byte order.
    // These two lines are all that is required to prevent many existing implementations
    // vulnerable to adaptive chosen ciphertext attacks using the timing side channel.
    receivedHMAC = hashAlgorithm.ComputeHash(receivedHMAC);
    calculatedHMAC = hashAlgorithm.ComputeHash(calculatedHMAC);

    for (int i = 0; i < calculatedHMAC.Length; i++) {
        if (receivedHMAC[i] != calculatedHMAC[i]) {
            throw new CryptographicException("HMAC verification failure.");
        }
    }
}