Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60821
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.53 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAJWj5+FRJjhyFQWbwzbvEzbq4Uxhi2kKt3FGtO34Q-mfOFd1jg@mail.gmail.com>
References: <CAAyV7nGa5iPBw4fWTEtURxs5_3uNPcKEhaetRLRTcwjAdtz7bA@mail.gmail.com>
	<CAJWj5+FRJjhyFQWbwzbvEzbq4Uxhi2kKt3FGtO34Q-mfOFd1jg@mail.gmail.com>
Date: Thu, 14 Jun 2012 07:08:22 -0400
Message-ID: <CAAyV7nGLkkCFGyx9aGfdeQqJLkhTWp1OXvDfmR29-f_8v_4tQQ@mail.gmail.com>
To: Simon Schick <simonsimcity@googlemail.com>
Cc: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] [DRAFT] RFC - hash_pbkdf2 addition
From: ircmaxell@gmail.com (Anthony Ferrara)

Simon,

> I personally would rename the 2nd parameter to $data as this function is not
> only meant for creating secure hashes from passwords.

Well, I understand your sentiment. But PBKDF stands for Password Based
Key Derivation Function. Even the spec calls that parameter password:


PBKDF2 (P, S, c, dkLen)

   Options:        PRF        underlying pseudorandom function (hLen
                              denotes the length in octets of the
                              pseudorandom function output)

   Input:          P          password, an octet string
                   S          salt, an octet string
                   c          iteration count, a positive integer
                   dkLen      intended length in octets of the derived
                              key, a positive integer, at most
                              (2^32 - 1) * hLen

   Output:         DK         derived key, a dkLen-octet string


So in this case, I feel calling the parameter "password" is justified...

Thanks,

Anthony