Re: [babel] babel-hmac: key requirements

[Markus Stenberg <[e-mail]>]

On 12.01.2019, at 14.32, Juliusz Chroboczek <[e-mail]> wrote:
>> I've also discovered that the HMAC RFC (RFC 2104) says:
> 
> Both of these look extremely naive to my untrained eyes (and 2104 is
> confusing).  Better approaches include:
> 
>  - drawing the key randomly before distribution (RFC 4086);
>  - using a proper KDF to derive a key from a passphrase (see e.g. RFC 5869).
> 
> As mentioned above, the key generation should happen offline, and is
> therefore out of scope for this draft.

+1.

If one really cares about security, few bytes of ASCII is not really what you want to use as key; ideally, very close to random bits, and plenty of them.

One way of sourcing them is by deriving them from passphrase using some computation which is hard to brute-force though, so even if I use password 'Markus rul3s', someone is unlikely to bother trying to bruteforce it and the clever 3 is sufficient as a security mechanism if it takes (say) minute per attempt on modern CPU.

e.g. RFC5869 is a good starting point (or its SHA-2 application in RFC6234).

>> My preference is that we have something in the HMAC draft, not too much
>> unlike the OSPF text.
> I disagree.  RFC 5709 is very naive, if a key is generated from user
> input, that should be done offline, and using a proper KDF, not the naive
> procedure described in 5709.

+1.

All the classic 'let's HMAC and call it done' mechanisms are completely obsolete as security mechanisms, unless the input to HMAC is in and of itself pseudorandom garbage of sufficient length and not passphrase in the first place.

Disclaimer: These are 'old school' recommendations, current KDF state of the art is bit different IIRC but even these are much better than the good old IETF standard (toss MD5 in), or 'modern-ish' IETF standard (toss HMAC-SHA in) way.

Draft should possibly state that if passphrases are used, KDF of SOME SORT should be used, but the actual KDF is IMHO implementation matter and as long as all implementations can be configured with same bytes that come out of KDF they would interoperate.

Cheers,

-Markus