[babel] MAC and key size

[Juliusz Chroboczek <[e-mail]>]

Dear Barbara,

HMAC is defined using two keys:

  - K, which is the original key provided by the user;
  - K', which is exactly the block size of the underlying hash.

K' is defined as

  - K' = K·0⋯0 if |K| < block size
  - K' = K     if |K| = block size
  - K' = H(K)  if |K| > block size

Now it looks like Ben and us disagree about which key should be stored in
the information model: Ben wants it to be K, while I would prefer it to be
K', and any hashing should be done before the key is inserted into the
management interface.

A possible compromise would be to allow the hashing to happen in the
management interface (i.e. to allow the information model to store
K rather than K'), but add a note to the RFC saying that for security
reasons the key SHOULD be no larger than the underlying hash's block size,
it SHOULD be at least the digest size, and put a reference to Section 7 of
RFC 8967.

— Juliusz