Reference for HMAC

[MarcusJGStreets]

The documentation for HMAC currently uses RFC 2104 as the primary reference.

NIST has published a new document SP 800-224 that is still ipd - which is intended to replace FIPS 198-1.

I wonder whether we should either add this as a secondary reference, or even make it the primary reference once it goes from ipd to final.

[athoelke]

Certainly we should add this as a reference after it is published as final. I think we need to keep RFC2104, as there is a difference in what is permitted/recommended:

• SP 800-224 requires a key to be at least 128 bits. This is to prevent applications using insecurely short HMAC keys - but shorter keys are not prohibited in the original (RFC2104/FIPS 198-1) definition, or in some existing use cases.
• SP 800-224 recommendeds that keys are no larger than the hash block size. This is to avoid key pre-hashing, and resulting in a long key and it hash being 'the same HMAC key'.
• SP 800-224 requires the output tag length to be at least 32 bits, and recommends at least 64 bits. This is to avoid insecure applications, particularly in deployments where an attacker can make multiple attempts to forge tags for the same message.
• SP 800-224 only includes approved hash functions from SHA2 and SHA3, and may also deprecate or remove 224-bit hash functions as <128-bit security strength will fall out of favour from 2030 onwards.

For compatibility with existing implementations and application uses of HMAC in the API, we cannot adopt the new NIST constraints as requirements. Howevere, we should probably recommend that implementors and users consider the NIST guidance in SP 800-224 on secure use of HMAC.