Bug 23097 - Underspecified behavior of verify() with regards to truncated signature

Thinking about this more, it really seems unadvisable to truncate MACs without explicit instruction from the caller. I'm leery about issues like with XMLSec: http://www.w3.org/blog/2009/07/hmac-truncation-in-xml-signatu/

Imagine a script that receives a signature from somewhere and passes it to verify() without checking its length (because people are lazy like that). It's created a potentially exploitable oracle.

Can we just add a truncation length parameter to the HmacParams and recommend that implementations define a floor below which they will refuse to truncate? That way the above example can be fixed, as the input signature will be rejected if it wasn't exactly the expected length.