Re: [babel] Babel-MAC: Blake2s is 128-bits by default

["STARK, BARBARA H" <[e-mail]>]

Just to confirm (because assuming is bad)...

> >> This does raise one question, though (as I just found out while
> >> implementing the option for a 128-bit version): How does this impact the
> >> recommendations for key size?
> >
> > I suggest that they remain the same (SHOULD be 32 bytes).
> >
> > The digest size impacts the overhead carried by every packet.  Not so the
> > key size: increasing the key size is essentially free.  As a matter of
> > fact, Blake2s will pad the key with zeroes before it is used.
> >
> > Thus:
> >
> >   - allowing shorter keys gains no generality (the user may achieve the
> >     same result by padding with zeroes before passing the key to Blake2s);
> >
> >   - disallowing shorter keys causes confusion (by using a value different
> >     from both HMAC-SHA-256 and the Blake2s maximum), and has no
> measurable
> >     benefits.
> >
> > I do not believe that it impacts the security in any way (2^128 ns is
> > roughly 10^12 times the age of the universe), but I could be wrong.
> 
> Yeah, makes sense, let's keep it at 32 bytes :)

... this means that other than changing "BLAKE2s" to "BLAKE2s-128" (consistent
with the list of "possible values" change), no other change is needed to the text 
in info model re BLAKE2s key length:

      If the algorithm is "BLAKE2s-128",
      the length MUST be between 0 and 32 bytes inclusive, as described
      in [RFC7693].

Barbara