Fernet: HMAC Key size smaller than SHA-256 output size

[wkral]

Discovered this by browsing issues in the spec: fernet/spec#8 which points to the HMAC RFC stating that this isn't a great idea to have a key size smaller than the algorithm's output size. https://tools.ietf.org/html/rfc2104#section-3

This is further supported by the SHA-256+ RFC https://tools.ietf.org/html/rfc4868#section-2.1.1 which states that the key length MUST be equal to the output length.

The Fernet code selecting AES-128 and SHA-256 has a combined key of 32 bytes or 256 bits and enforces that size in the code. With those selected algorithms the key size should be 128 + 256 or 384 bits total.

[reaperhulk]

This can only be addressed in the spec since we only implement, not design. The lack of maintenance on the fernet spec is more than a little frustrating, but we'll keep at it.