RFC 7693 provides the following table of standard parameter sets for BLAKE2b without a key (where nn is the hash size in bytes):
| | Collision | Hash | | Algorithm | Security | nn | +-------------+-----------+------+ | BLAKE2b-160 | 2**80 | 20 | | BLAKE2b-256 | 2**128 | 32 | | BLAKE2b-384 | 2**192 | 48 | | BLAKE2b-512 | 2**256 | 64 |
However, for BLAKE2b with a key it only notes that the key length kk must be in the range
0 <= kk <= 64 bytes. The BLAKE2 documentation doesn't seem to provide any more detail.
In RFC 2104, the definition of HMAC includes specific recommendations for the key length (where B is the block length and L the length of hash outputs of the hash function H):
The key for HMAC can be of any length (keys longer than B bytes are first hashed using H). However, less than L bytes is strongly discouraged as it would decrease the security strength of the function. Keys longer than L bytes are acceptable but the extra length would not significantly increase the function strength.
What are the recommended combinations of key length and output length for BLAKE2b as a MAC to get the usual 128-/256-bits of security?
What is a good way to estimate the bits of security provided by other combinations?
What is some good reading material that covers questions like this, since the audience of the RFC is clearly assumed to know such things?