use 512 bit keys for HMAC-SHA256

[overheadhunter]

When HKDF uses SHA-512, the native output size is 512 bit.

When HMAC uses SHA256, the internal block size is also 512 bit. If the key is shorter than the block size, it gets padded.

I.e. using a 256 bit key introduces unnecessary intermediate steps:

flowchart LR
  hkdf["HKDF-SHA512"] -->|"512 bit key"| truncate
  truncate -->|"256 bit key"| pad
  pad -->|"512 bit key"| hmac["HMAC-SHA256"]

Loading

So let's simplify this to:

flowchart LR
  hkdf["HKDF-SHA512"] -->|"512 bit key"| hmac["HMAC-SHA256"]

Loading

Not only does this remove unnecessary operations. Furthermore, truncating and then padding the key reduce the effective key size (assuming surrounding operations provide equally high security).