Re: [babel] Babel-MAC: Blake2s is 128-bits by default

[Toke Høiland-Jørgensen <[e-mail]>]

Juliusz Chroboczek <[e-mail]> writes:

> After reading your replies, and thinking it over carefully, I disagree
> with the apparent consensus.  I think Blake2s in Babel-MAC should use
> 128-bit keys, as in the initial implementation.  Please hear me out.
>
> Toke and Dave originally suggested adding Blake2s to Babel-HMAC for two
> reasons:
>
>   - it is more computationally lightweight on platforms that don't
>     implement SHA-256 in hardware;
>   - it may serve as a fallback if SHA2 is ever broken.
>
> While I am still not quite convinced by these arguments, I've agreed to
> add the SHOULD Blake2s and to implement Blake2s for the following reasons:
>
>   - it serves as a good example of adding a new algorithm to Babel-MAC;
>   - with 128-bit signatures, it is useful on low-rate networks, which
>     Babel is commonly used with.
>
> For these reasons, we implemented Blake2s with 128-bit signatures.
> Unfortunately, some confusion ensued, Toke implemented Blake2s with
> 256-bit signatures, Antonin changed our implementation to interoperate
> with Toke's (without discussing the issue with me beforehand), hence the
> current situation.

Note sure that I quite agree with your history here, but that doesn't
really matter; I'm not actually opposed to 128-bit signatures per se,
although I would be more comfortable if someone with a crypto background
could weigh in with an opinion on this.

(Note that the way blake2s implements this is just by truncating the
output to whatever size you specify, the rest of the algorithm is
exactly the same).

> If Blake2s uses 256-bit signatures, then I see little convincing reason to
> keep it around in addition to SHA-256.  For this reason, I recommend the
> following course of action:
>
>   1. Toke agrees to switch to 128-bit Blake2s signatures;

I think what would happen is that Bird would support both. It already
supports a whole bunch of other signature schemes (some of which, like
MD5, should probably not be used), and my patch adds support for both
blake2s and blake2b. I'll think about what the best UI for this is, and
ask the Bird devs as well I suppose.

-Toke