Is this function a secure MAC? Consider the following function:
$f_k(mm')=\operatorname{HMAC}_{\operatorname{HMAC}_k(m)}(mm')$  

Can I use $f$ as a secure MAC?
If you look at $k' = \operatorname{HMAC}_k(m)$ as a key derivation function then you'd expect that $\operatorname{HMAC}_{k'}(mm')$ is secure, even if $m$ is also used to derive $k'$. So from a purely functional point of view then yes, this should be secure.

Also from a functional view I would wonder why there is a repetition of $m$, because as it is used to derive key $k'$ it is already included in the calculation of the MAC value, and repeating it is therefore moot; the repetition of $m$ doesn't do anything for security. You could just use $m$ for the KDF alone, so then the outer HMAC is just $\operatorname{HMAC}_{k'}(m')$

Finally, the presumption is of course that $k$ has enough bits to be used as a HMAC key; generally the same size key as the hash output is recommended.



I don't see any reason why $f_k(mm')=\operatorname{HMAC}_k(\operatorname{enc}(m,m'))$ would not work, where $\operatorname{enc}$ is a canonical encoding function. This is a more efficient MAC if $m$ is large.