Multikeyed Hash: known algorithms? A MAC (or HMAC) can be represented by the general formula:

MAC = H(key, message)


I am calling "Multikeyed Hash" the operation (probably there exists already a name for this concept, which I don't know) below:

MkHash = H(key1, key2, key3, ...., keyN,  message)


Are there known algorithms to compute that? Note that I can't simply concatenate the keys myself, because an attack could be built using the fact that:

MkHash = H((key1, key2), key3, ...., keyN,  message)


would result in the same MkHash.
Are there known algorithms to compute that? Note that I can't simply concatenate the keys 


No, you can't just concatenate them, but there are simple modifications to simple concatenation which does make it safe.

The easiest may be to simply prepend the length of every key in the concatination.  That is, if we have:

key1, key2, ..., keyN


we form the string

len(key1) || key1 || len(key2) || key2 || ... || len(keyN) || keyN


Where len(X) is a simple encoding of the length; it might be just an n byte encoding of the length (if you know that no key will be longer than $256^n$ bytes long), or you could go fancier and (say) reuse the variable length encoding from DER.

That way, if you introduce any other sequence of keys, you'll generate a distinct string, and so don't run into collision problems.

This is well known, but not greatly discussed (probably because it is assumed to be fairly obvious/trivial).

The only other thing is that you'd need a MAC that takes a variable length key.  Most don't; however one that does is HMAC.  The other possibility is to just use a collision-resistant hash function on the string (and use the result as the real fixed-length MAC key).