Fernet is a described as a "high level symmetric encryption recipe" (source) that seems to be the default high level encryption scheme in the cryptography
python library. The construction is described in full here, it basically takes a message $m$ and produces a token as follows:
- Encrypt $m$ via AES-CBC i.e. $IV \gets \{0,1\}^{128}$, $c = \text{AES-CBC}_{k1}(m, IV)$
- Take a timestamp $t$, version number $v$ and compute $tag = \text{HMAC}_{k2}(v || t || IV || c)$
- Send $token = v || t || IV || c || tag$ to the recipient
The recipient then takes the $token$ and decrypts as follows:
- Verify that $\text{HMAC}_{k2}(v || t || IV || c)$ == $tag$
- Decrypt $c$ via AES-CBC i.e. $m = \text{AES-CBC}_{k1}(c, IV)$ (only if tag is correct of course)
Key exchange is not included and it is assumed two 128 bit keys $k1, k2$ can be securely established. My questions are the following:
The spec states that
Fernet tokens are not self-delimiting. It is assumed that the transport will provide a means of finding the length of each complete fernet token.
Does this allow us to tamper with the tokens in a way we shouldn't be able to by adding data to the front or the end of a token? My intuition says no as HMAC is computed over all the data and the composition is Encrypt-then-MAC.
Is there any danger in computing HMAC (with SHA256 as the underlying hash function) using only a 128 bit key? My understanding is that the standard key size would be 256 bits in this case.