Re: [babel] babel-hmac: key requirements

[Juliusz Chroboczek <[e-mail]>]

> Draft should possibly state that if passphrases are used, KDF of SOME
> SORT should be used, but the actual KDF is IMHO implementation matter
> and as long as all implementations can be configured with same bytes
> that come out of KDF they would interoperate.

So it looks like I should add something to the Security Considerations
section.  What about

  In addition to the above, the mechanism described in this draft relies
  on an attacker being unable to guess the HMAC key, whether by brute
  force or by other means.  Ideally, the HMAC key SHOULD be generated
  randomly using a strong random number generator [RFC4086] and
  distributed to the routers using some sufficiently secure mechanism
  (e.g., ssh [RFC4251]).  If the HMAC key is generated from user input (a
  "passphrase"), then the passphrase SHOULD NOT be stored on the
  individual routers: the key SHOULD be generated on a secure host using
  a sufficiently strong Key Derivation Function (KDF) RFC5869] [RFC6234]
  and, again, the resulting distributed to the routers using some
  sufficiently secure mechanism.  In order to make offline key generation
  practical, implementations SHOULD use the key provided by the user with
  no transformation of any kind.