Re: [babel] Babel-MAC: Blake2s is 128-bits by default

[Toke Høiland-Jørgensen <[e-mail]>]

"STARK, BARBARA H" <[e-mail]> writes:

> Just to confirm (because assuming is bad)...
>
>> >> This does raise one question, though (as I just found out while
>> >> implementing the option for a 128-bit version): How does this impact the
>> >> recommendations for key size?
>> >
>> > I suggest that they remain the same (SHOULD be 32 bytes).
>> >
>> > The digest size impacts the overhead carried by every packet.  Not so the
>> > key size: increasing the key size is essentially free.  As a matter of
>> > fact, Blake2s will pad the key with zeroes before it is used.
>> >
>> > Thus:
>> >
>> >   - allowing shorter keys gains no generality (the user may achieve the
>> >     same result by padding with zeroes before passing the key to Blake2s);
>> >
>> >   - disallowing shorter keys causes confusion (by using a value different
>> >     from both HMAC-SHA-256 and the Blake2s maximum), and has no
>> measurable
>> >     benefits.
>> >
>> > I do not believe that it impacts the security in any way (2^128 ns is
>> > roughly 10^12 times the age of the universe), but I could be wrong.
>> 
>> Yeah, makes sense, let's keep it at 32 bytes :)
>
> ... this means that other than changing "BLAKE2s" to "BLAKE2s-128" (consistent
> with the list of "possible values" change), no other change is needed to the text 
> in info model re BLAKE2s key length:
>
>       If the algorithm is "BLAKE2s-128",
>       the length MUST be between 0 and 32 bytes inclusive, as described
>       in [RFC7693].

AFAICT, you are quite right! :)

-Toke