Commit 98c6e4b
doc: use secure key length for HMAC generateKey
The examples for generateKey() and generateKeySync() generate 64-bit
HMAC keys. That is inadequate for virtually any HMAC instance. As per
common NIST recommendations, the minimum should be roughly 112 bits, or
more commonly 128 bits.
Due to the design of HMAC itself, it is not unreasonable to choose the
underlying hash function's block size as the key length. For many
popular hash functions (SHA-256, SHA-224, SHA-1, MD5, ...) this happens
to be 64 bytes (bytes, not bits!). This is consistent with the HMAC
implementation in .NET, for example, even though it provides virtually
no benefit over a 256-bit key.
PR-URL: #48052
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>1 parent 8090d29 commit 98c6e4b
1 file changed
Lines changed: 4 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -3665,7 +3665,7 @@ const { | |||
| 3665 | 3665 | generateKey, | |
| 3666 | 3666 | } = await import('node:crypto'); | |
| 3667 | 3667 | ||
| 3668 | - generateKey('hmac', { length: 64 }, (err, key) => { | ||
| 3668 | + generateKey('hmac', { length: 512 }, (err, key) => { | ||
| 3669 | 3669 | if (err) throw err; | |
| 3670 | 3670 | console.log(key.export().toString('hex')); // 46e..........620 | |
| 3671 | 3671 | }); | |
@@ -3676,7 +3676,7 @@ const { | |||
| 3676 | 3676 | generateKey, | |
| 3677 | 3677 | } = require('node:crypto'); | |
| 3678 | 3678 | ||
| 3679 | - generateKey('hmac', { length: 64 }, (err, key) => { | ||
| 3679 | + generateKey('hmac', { length: 512 }, (err, key) => { | ||
| 3680 | 3680 | if (err) throw err; | |
| 3681 | 3681 | console.log(key.export().toString('hex')); // 46e..........620 | |
| 3682 | 3682 | }); | |
@@ -3939,7 +3939,7 @@ const { | |||
| 3939 | 3939 | generateKeySync, | |
| 3940 | 3940 | } = await import('node:crypto'); | |
| 3941 | 3941 | ||
| 3942 | - const key = generateKeySync('hmac', { length: 64 }); | ||
| 3942 | + const key = generateKeySync('hmac', { length: 512 }); | ||
| 3943 | 3943 | console.log(key.export().toString('hex')); // e89..........41e | |
| 3944 | 3944 | ``` | |
| 3945 | 3945 | ||
@@ -3948,7 +3948,7 @@ const { | |||
| 3948 | 3948 | generateKeySync, | |
| 3949 | 3949 | } = require('node:crypto'); | |
| 3950 | 3950 | ||
| 3951 | - const key = generateKeySync('hmac', { length: 64 }); | ||
| 3951 | + const key = generateKeySync('hmac', { length: 512 }); | ||
| 3952 | 3952 | console.log(key.export().toString('hex')); // e89..........41e | |
| 3953 | 3953 | ``` | |
| 3954 | 3954 | ||
0 commit comments