I am implementing hmac-sha-512 in an integrated system. However, one subsystem is only supports the use of 256-bit keys.
I read in https://tools.ietf.org/html/rfc4868 that:
However, note that [HMAC] strongly discourages a key length less than the output length. Nonetheless, we describe handling of shorter lengths here in recognition of shorter lengths typically chosen for IKE or IKEv2 pre-shared keys.
These key length restrictions are based in part on the recommendations in [HMAC] (key lengths less than the output length decrease security strength, and keys longer than the output length do not significantly increase security strength), and in part because allowing variable length keys for IPsec authenticator functions would create interoperability issues.
In what way does using a 256-bit key rather than a 512-bit key with HMAC-SHA-512 decrease its security strength? Is it not advisable to proceed with a 256-bit key?