Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Blake2 parameters cannot be used without a key #482

Open
threema-lenny opened this issue May 24, 2023 · 3 comments · May be fixed by #612
Open

Blake2 parameters cannot be used without a key #482

threema-lenny opened this issue May 24, 2023 · 3 comments · May be fixed by #612

Comments

@threema-lenny
Copy link

threema-lenny commented May 24, 2023

The personal and salt parameters for Blake2 can only be used in combination with a key because the non-MAC variants don't expose the parameters as input.

I've also tried using the MAC variant with an empty key, but it appears an initial Blake2 round is done with an all-zero key in that case.

Would it be acceptable if we change the signature of the Mac variant so that (either):

  1. key is Option, or
  2. a key of length 0 does not do the initial Blake2 round?

Or would it be considered a strict violation to use a MAC without a key?

@edward-shen
Copy link
Contributor

edward-shen commented Oct 9, 2023

Related: #509

I don't think it's correct to even construct a zero-key-length blake2 MAC variant, and right now I think blake 0.10 permits this in a way that leads to incorrect blake2 construction.

@edward-shen
Copy link
Contributor

Closing the loop, #510 was merged to deny constructing zero-length keys for blake2Mac variants.

@threema-lenny
Copy link
Author

threema-lenny commented Jan 18, 2024

Thanks for taking care of the empty key construction bit! There's still the use case of using Blake2 without a key but with personal and salt and that's the only reason why I currently have to maintain a fork. But at least #510 makes it more clear what the proposed solution would have to be which is making key an Option.

@threema-theo threema-theo linked a pull request Aug 7, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants