Re: HMAC (SHA1) key longer than 81 characters not possible?

Hi,

that number 81 seems completly random to me. 81 characters (bytes) is 648 bits. Here is a quote from [RFC 2104 - HMAC: Keyed-Hashing for Message Authentication|http://www.faqs.org/rfcs/rfc2104.html].

 

The key for HMAC can be of any length (keys longer than B bytes are

   first hashed using H).  However, less than L bytes is strongly

   discouraged as it would decrease the security strength of the

   function.  Keys longer than L bytes are acceptable but the extra

   length would not significantly increase the function strength. (A

   longer key may be advisable if the randomness of the key is

   considered weak.)

 

So there is no limit for key size but any key longer than block size (B bytes) of hash function will be compressed to B bytes. The key should be longer than output size of has function (L bytes) which for SHA-1 is 160 bits = 20 bytes. The internal state of SHA-1 is 512bits == 64 bytes.

So I would suggest that to use SHA-1 functin to reduce any key longer than 64 bytes to 64 bytes and then to pass a new key to SET_HMAC_KEY.

Cheers