Re: [babel] Babel-MAC: Blake2s is 128-bits by default

I support this change.

David

On Fri, Nov 6, 2020 at 2:31 PM Juliusz Chroboczek <jch@irif.fr> wrote:

> Dear all,
>
> We've had a discussion with Barbara and Toke today, and we've come to the
> conclusion that there is an oversight in draft-ietf-babel-hmac-12.  In
> Section 4.1, we say
>
>    Every implementation MUST implement HMAC-SHA256 as defined in [RFC6234]
>    and Section 2 of [RFC2104], SHOULD implement keyed BLAKE2s [RFC7693],
>    and MAY implement other MAC algorithms.
>
> As Valery Smyslov noted, BLAKE2s is able to produce hashes of any size
> between 1 and 32 octets (8 and 256 bits).  However, both implementations
> of Babel-MAC only ever produce 16-octet BLAKE2s hashes.  This is done for
> the following reasons:
>
>   - Babel-MAC is not believed to be vulnerable to collision attacks, hence
>     128 bits is believed to be large enough;
>
>   - BLAKE2s is intended as a more lightweight alternative to SHA2-256,
>     which is the recommended algorithm if 128-bit hashes are believed to
>     not be sufficient.
>
> However, the digest size is not indicated in the draft.  Therefore, in
> order to align the draft with implementation practice, I am asking the
> list's permission to clarify the draft by changing the paragraph cited
> above to say:
>
>    Every implementation MUST implement HMAC-SHA256 as defined in [RFC6234]
>    and Section 2 of [RFC2104], SHOULD implement keyed BLAKE2s [RFC7693]
>    with 16-octet (128-bit) hashes, and MAY implement other MAC algorithms
>    and hash sizes.
>
> Donald, assuming nobody objects to the above, what is the right point at
> which to request this clarification?  AUTH48?  Or publish an erratum just
> after the RFC goes out?
>
> Sorry for the oversight, and thanks for everyone's help,
>
> -- Juliusz
>
> _______________________________________________
> babel mailing list
> babel@ietf.org
> https://www.ietf.org/mailman/listinfo/babel
>