Re: [babel] Babel-MAC: Blake2s is 128-bits by default

[Toke Høiland-Jørgensen <[e-mail]>]

Juliusz Chroboczek <[e-mail]> writes:

>> This does raise one question, though (as I just found out while
>> implementing the option for a 128-bit version): How does this impact the
>> recommendations for key size?
>
> I suggest that they remain the same (SHOULD be 32 bytes).
>
> The digest size impacts the overhead carried by every packet.  Not so the
> key size: increasing the key size is essentially free.  As a matter of
> fact, Blake2s will pad the key with zeroes before it is used.
>
> Thus:
>
>   - allowing shorter keys gains no generality (the user may achieve the
>     same result by padding with zeroes before passing the key to Blake2s);
>
>   - disallowing shorter keys causes confusion (by using a value different
>     from both HMAC-SHA-256 and the Blake2s maximum), and has no measurable
>     benefits.
>
> I do not believe that it impacts the security in any way (2^128 ns is
> roughly 10^12 times the age of the universe), but I could be wrong.

Yeah, makes sense, let's keep it at 32 bytes :)

-Toke