Re: [babel] Babel-MAC: Blake2s is 128-bits by default

[Toke Høiland-Jørgensen <[e-mail]>]

Juliusz Chroboczek <[e-mail]> writes:

>>> Toke and Dave originally suggested adding Blake2s to Babel-HMAC [...]
>
>> Note sure that I quite agree with your history here,
>
> It's quite likely I got it wrong, sorry if that's the case.
>
>> I'm not actually opposed to 128-bit signatures per se, although I would
>> be more comfortable if someone with a crypto background could weigh in
>> with an opinion on this.
>
> Valery, perhaps you could help?
>
>>> 1. Toke agrees to switch to 128-bit Blake2s signatures;
>
>> I think what would happen is that Bird would support both.
>
> Ok.
>
> You didn't address the most important question: do you agree with modifying
> the RFC-to-be so that the SHOULD applies to 128-bit signatures, and
> clarifying the information model that the "Blake2s" algorithm implies
> 128-bit signatures?

I asked my go-to crypto guy who assured me that 128 bits is sufficient
for this use case. So no objections from me :)

(He also helpfully pointed out that I was completely wrong to assert
that Blake2s just truncates the hash if it's configured for shorter
output; so much for my C reading comprehension skills :/)

-Toke