1
$\begingroup$

I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below. Specifically for TLS implementations of HMAC.

I found this table in RFC5246:

MAC       Algorithm    mac_length  mac_key_length
--------  -----------  ----------  --------------
NULL      N/A              0             0
MD5       HMAC-MD5        16            16
SHA       HMAC-SHA1       20            20
SHA256    HMAC-SHA256     32            32

Which lets me populate this information:

MD5 HMAC uses a 128 bit Key and produces 128 bit digest
SHA1 HMAC uses a 160 bit key and produces 160 bit digest
SHA224 HMAC uses a ____ bit key and produces a 256 bit digest, truncated to 224 bits
SHA256 HMAC uses a 256 bit key and produces a 256 bit digest
SHA384 HMAC uses a ____ bit key and produces a 512 bit digest, truncated to 384 bits
SHA512 HMAC uses a ____ bit key and produces a 512 bit digest

But I am unable to find definitive key sizes for SHA224, SHA384, and SHA512.

The HMAC RFC (2104) lists this:

We denote by B the byte-length of such blocks (B=64 for all the above mentioned examples of hash functions), and by L the byte-length of hash outputs (L=16 for MD5, L=20 for SHA-1). The authentication key K can be of any length up to B ... the minimal recommended length for K is L bytes (as the hash output length). See section 3 for more information on keys.

Which implies the Key Size must be at least the hashing algorithm's digest size, and confirms what I've "filled in" above.

I presume, given the above that in all cases the HMAC key size should be at least the length of the digest, which would make the SHA384 HMAC key size a minimum of 384 bits, but I can not seem to find definitive confirmation of the fact.

$\endgroup$
3
$\begingroup$

I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below

Good question. It turns out that TLS always uses the same length of key as the hash function length (so HMAC-SHA384 would use a 48 byte key).

However, I also can't find any RFC which actually states this. Neither RFC5246 (which acknowledges HMAC-SHA384 and HMAC-SHA512 as potential MAC algorithms, but doesn't define any ciphersuites that use them) nor RFC5289 (the earliest RFC I can find which actually does define a ciphersuite with HMAC-SHA384 as a MAC algorithm) actually address it.

I suspect that's just something that fell through the cracks; RFC5246 only defined it for those MACs which were actually defined ciphersuites at that time; the author of RFC5289 apparently overlooked the issue.

$\endgroup$
  • $\begingroup$ Thanks for confirming both the key sizes and that the explicit directive isn't in the RFC's =) $\endgroup$ – Eddie Jun 18 '18 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.