Subject: [babel] BASE64 and hex encoding HMAC keys for user presentation

From: Dave Taht <[email-masked]>
Date: Sat, 1 Dec 2018 12:11:09 -0800

I would like the bird and babel implementations to allow for and use
BASE64 and hex encodings.

This allows for a shorter, more human friendly representation of both
cryptographically generated keys and the keys humans are more likely
to remember and type without error. In the latter case, guidelines as
to length, mixed case and punctuation would be useful.

There are only so many hexadecimal jokes that are easy to remember,
deadbeef being the most common. Requiring that a hex key be prefixed
with 0x and that keys otherwise shown users
be in base64 would make for an easier deployment, and keys like
Get0ffMyLawnBadGuys and NSAdeliveryVAN easier on the eyes than the
equivalent: 0x19eb747df3322dac2705a746bb2b and 0x35201d7a58af7abc9500
and still allows for harder keys to be cryptographically generated by
other tools, like IG/MmDjiVJW0+ojz32+4KDtVuGlJJKkhYEEEkpbwTkE=

I do not off the top of my head know how much this compromises the
dynamic range of a given key, but I would hope that being

-- 

Dave Täht
CTO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-831-205-9740

---

From: Dave Taht <[email-masked]>
Date: Sat, 1 Dec 2018 12:12:19 -0800

> dynamic range of a given key, but I would hope that being

easier on humans, it makes for an easier deployment.

-- 

Dave Täht
CTO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-831-205-9740

---

From: Toke Høiland-Jørgensen <[email-masked]>
Date: Sun, 02 Dec 2018 00:10:24 +0100

> BASE64 and hex encodings.

In Bird's case, the password parsing code is part of the core; not going
to special-case it for Babel.

-Toke

---

From: Juliusz Chroboczek <[email-masked]>
Date: Sat, 22 Dec 2018 17:25:43 +0100

> to length, mixed case and punctuation would be useful.

I think that the HMAC key should be generated automatically.  I'd hope
that any actual production deployment of HMAC would generate HMAC keys
either randomly or by using a suitable KDF (or whatever the right acronym
is) and distribute it automatically.

(At the current time, I'm not advocating designing a key distribution
protocol to go with HMAC -- I'm in favour of using a centralised script
that uses ssh to distribute keys.  Please see https://cr.yp.to/djbdns/tcp.html)

So no, I'd rather not encourage people to generate HMAC keys manually.

-- Juliusz

---

From: Toke Høiland-Jørgensen <[email-masked]>
Date: Sat, 22 Dec 2018 17:35:43 +0100

> is) and distribute it automatically.

Should we pick a KDF? Not necessarily for the RFC, but at least try to
get compatibility between bird and babeld, so users can just input a
password and expect things to work?

-Toke

---

From: Juliusz Chroboczek <[email-masked]>
Date: Sun, 23 Dec 2018 21:40:10 +0100

> password and expect things to work?

I think we might need more deployment experience before we can answer that.

At this early stage, however, I wouldn't expect the master key to be
distributed -- the KDF would be applied to the master key on a central
node, and the derived secret is what gets distributed to the babeld and
BIRD instances.  So having a common syntax for the HMAC secret should be
good enough.

-- Juliusz

---

From: Toke Høiland-Jørgensen <[email-masked]>
Date: Mon, 24 Dec 2018 23:08:56 +0100

> BIRD instances.  So having a common syntax for the HMAC secret should be

Fair enough :)

-Toke

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 25 Dec 2018 20:04:18 -0500

If you need a KDF, I recommend RFC 5869.

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 1424 Pro Shop Court, Davenport, FL 33896 USA
 [email-masked]

On Mon, Dec 24, 2018 at 5:09 PM Toke Høiland-Jørgensen <[email-masked]> wrote:

> _______________________________________________
> Babel-users mailing list
> [email-masked]
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/babel-users