Keys in HMAC and NMAC I'm quite new to this topic and have several questions concerning HMAC and NMAC:


Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the first/second key?
What is the purpose of ipad and opad in HMAC? 
What if the key is longer than the block size?
Can the key be longer than the number of input bits of a hash function?
NMAC is really just an "education tool" on the way to HMAC and I don't think anyone intended it to be used. The two keys are needed since the first and second hashes have different purposes. The first hash on the message is just needed to get collision resistance, whereas the second hash is supposed to provide a pseudorandom function type property. As such, it actually suffices to have just one key (on the second hash). However, the first key is included as a conservative measure so that even if the hash is broken and collisions can be found, it does not mean that NMAC/HMAC are broken since the attacker has to find a collision where a key is used that it doesn't know. The best way to look at NMAC/HMAC is a specific implementation of "hash and MAC" (analogous to "hash and sign").

The purpose of ipad and opad in HMAC is to get computationally independent keys for the first and second hashes. If we assume that the compression function acts like a pseudorandom generator when used in this special way with ipad and opad, then this follows. (It of course follows immediately in the random oracle model, but this is overkill and not needed.)

Nothing inherently bad happens if the key is longer than the block size, but nothing is gained either. 

I'm not sure what you mean by the key being longer than the number of inputs bits of the hash function. I guess that you mean the compression function (since the hash function is practically unlimited). If yes, then the key can be longer, but nothing is gained by it, so you shouldn't do it.