RE: Length of pre-shared key

[David Jablon <dpj@world.std.com>]

I don't see anywhere that RFC 2104 says anything about "stretch"ing
a short input key into a longer one.  What it does is to hash (squeeze?)
a key that's longer than 64 bytes into a hash block.

Also, one should not confuse a password with a key in this context.

At 02:17 PM 2/25/02 -0500, Andrew Krywaniuk wrote:
>I don't think there is a specific limit. After all, HMAC tells you how to
>stretch the input if it is less that the size of the hash output. But use
>your common sense: the shorter the input, the easier it will be for a
>cracking program to guess it. Also, it's the entropy in the password, not
>the length, that matters.