The RFC says that `secret` MUST be at least 128-bit.