Blake2b keyed hash variation specifies a maximum key length equal to the digest size. It implements this feature simply concatenating the zero-padded key to a boundary of the block size with the message and then hashing.

I am asking myself: Why this arbitrary key length limit? It is just a concatenation. Allowing arbitrary length keys zero-padded to the block boundary does not add extra complexity to the code nor breaks compatibility with current specification. Are there any security flaws making this slight variation?

  • 1
    $\begingroup$ Just a note: you can always use an expanding KDF over the result to create more key material (without, of course, extending the strength of the keying material). $\endgroup$ – Maarten Bodewes Feb 10 '18 at 2:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.