[babel] Babel-MAC: Blake2s is 128-bits by default

[Juliusz Chroboczek <[e-mail]>]

Dear all,

We've had a discussion with Barbara and Toke today, and we've come to the
conclusion that there is an oversight in draft-ietf-babel-hmac-12.  In
Section 4.1, we say

   Every implementation MUST implement HMAC-SHA256 as defined in [RFC6234]
   and Section 2 of [RFC2104], SHOULD implement keyed BLAKE2s [RFC7693],
   and MAY implement other MAC algorithms.

As Valery Smyslov noted, BLAKE2s is able to produce hashes of any size
between 1 and 32 octets (8 and 256 bits).  However, both implementations
of Babel-MAC only ever produce 16-octet BLAKE2s hashes.  This is done for
the following reasons:

  - Babel-MAC is not believed to be vulnerable to collision attacks, hence
    128 bits is believed to be large enough;

  - BLAKE2s is intended as a more lightweight alternative to SHA2-256,
    which is the recommended algorithm if 128-bit hashes are believed to
    not be sufficient.

However, the digest size is not indicated in the draft.  Therefore, in
order to align the draft with implementation practice, I am asking the
list's permission to clarify the draft by changing the paragraph cited
above to say:

   Every implementation MUST implement HMAC-SHA256 as defined in [RFC6234]
   and Section 2 of [RFC2104], SHOULD implement keyed BLAKE2s [RFC7693]
   with 16-octet (128-bit) hashes, and MAY implement other MAC algorithms
   and hash sizes.

Donald, assuming nobody objects to the above, what is the right point at
which to request this clarification?  AUTH48?  Or publish an erratum just
after the RFC goes out?

Sorry for the oversight, and thanks for everyone's help,

-- Juliusz