For learning purpose, I'm trying to implement HMAC using SHA256.
In the pseudo code proposed in Wikipedia, the algorithm first focus on how to shorten or expand the key :
if (length(key) > blocksize) {
key = hash(key) // keys longer than blocksize are shortened
}
if (length(key) < blocksize) {
// keys shorter than blocksize are zero-padded (where ∥ is concatenation)
key = key ∥ [0x00 * (blocksize - length(key))] // Where * is repetition.
}
Given I'm using SHA-256 that has a blocksize of 64 bytes and an output of 32 bytes :
- if the key length is greater than 64 bytes, it will be shortened to 32 bytes
- if the key length is less than 64 bytes, it will be expanded to 64 bytes
From what I read 32 bytes should provide enough security. But doesn't that seem odd that a 65 bytes key will provide less security than a 63 bytes key ?