Re: [babel] babel-hmac: key requirements

["STARK, BARBARA H" <[e-mail]>]

> > The provided HMAC Key MUST NOT be modified in any way prior to use
> > with the hash algorithm.
> 
> Which draft are we speaking about?  The management draft or the HMAC
> draft?

The HMAC draft. 

>From your comments, it seems that the "HMAC Key" referenced throughout babel-hmac is the exact set of bits used to compute the HMAC. If this is true, then this is an important fact that is not currently obvious from reading the draft. So the HMAC Key that is an input to an implementation of this spec must not be modified by the implementation prior to use.

An implementation of babel-hmac that hashes a provided HMAC Key value longer than the length of the hash must be considered in violation of the babel-hmac spec. Any user interface that accepts input of ASCII characters to generate an HMAC Key must be separate from the babel-hmac implementation. The existence of OSPF key "preparation" rules and the base HMAC RFC rules key preparation rules means the babel-hmac text needs to unambiguously state that such preparation is *not* done to an "HMAC Key" prior to its use in babel-hmac.

This will impose a requirement on the info-model to treat the HMAC Key as a binary field (like the router-id).

BTW, I'm fine with the text you proposed for the security section. But it doesn't solve the problem of ensuring there is no ambiguity regarding non-"preparation" of the key.
Barbara