I'm challenged because I don't know how to explain it. I'm trying to say that while the pattern fits and looks random, it is predictably random.
HMAC
is predictable - that's the whole point of a message authentication code, if it was truly random it wouldn't be much use!
However, it appears random (and for all extends and purposes
is random) if you don't know the secret and the input changes each time, even by 1 bit.
Will
Disclaimer: cryptography is not my strong point
So, I don't exactly understand what you're saying. HMAC is based on hashing. What you're saying is that all cryptographic hashing just 'appears random', which sounds very low to me. I thought the randomness of cryptography hashes was quite strong.
Also, isn't the HMAC just doing something to a hash? So the underlying security of the hash is still there.