Re: [babel] Babel-MAC: Blake2s is 128-bits by default

[Toke Høiland-Jørgensen <[e-mail]>]

Toke Høiland-Jørgensen <[e-mail]> writes:

> Juliusz Chroboczek <[e-mail]> writes:
>
>>>> Toke and Dave originally suggested adding Blake2s to Babel-HMAC [...]
>>
>>> Note sure that I quite agree with your history here,
>>
>> It's quite likely I got it wrong, sorry if that's the case.
>>
>>> I'm not actually opposed to 128-bit signatures per se, although I would
>>> be more comfortable if someone with a crypto background could weigh in
>>> with an opinion on this.
>>
>> Valery, perhaps you could help?
>>
>>>> 1. Toke agrees to switch to 128-bit Blake2s signatures;
>>
>>> I think what would happen is that Bird would support both.
>>
>> Ok.
>>
>> You didn't address the most important question: do you agree with modifying
>> the RFC-to-be so that the SHOULD applies to 128-bit signatures, and
>> clarifying the information model that the "Blake2s" algorithm implies
>> 128-bit signatures?
>
> I asked my go-to crypto guy who assured me that 128 bits is sufficient
> for this use case. So no objections from me :)

This does raise one question, though (as I just found out while
implementing the option for a 128-bit version): How does this impact the
recommendations for key size? I've been restricting the key size to
always be equal to the output size, so does this also imply that the key
size recommendation should change to 16 bytes?

-Toke