Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:98252
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain paragonie.com designates 74.125.82.178 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZWKqJpvWma1zdY8j+yFg-pMXBZZHpUHb=KhJQucCf+9Q@mail.gmail.com>
References: <CAGa2bXZWKqJpvWma1zdY8j+yFg-pMXBZZHpUHb=KhJQucCf+9Q@mail.gmail.com>
Date: Tue, 7 Feb 2017 15:22:15 -0500
Message-ID: <CAKws9z31kvAs16kU1QBfdTP+G0d21PYcRaCw2-8rdsZpsRxkFg@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>, Andrey Andreev <narf@devilix.net>, 
	Nikita Popov <nikita.ppv@gmail.com>
Content-Type: multipart/alternative; boundary=94eb2c1922160633080547f68153
Subject: Re: [PHP-DEV] hash_hkdf() signature
From: scott@paragonie.com (Scott Arciszewski)

--94eb2c1922160633080547f68153
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Tue, Feb 7, 2017 at 2:35 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi Nikita, Andrey and all,



=E2=80=8B<snip>=E2=80=8B
>



Regards,
>
> P.S. I'll be more careful, but I become very sloppy mail reader sometimes=
.
> I appreciate if you could let know via private email. Thank you!
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>

=E2=80=8BHi,=E2=80=8B

Although there are HKDF usage without salt, many HKDF applications with PHP
> require or are better with salt. e.g. Previous per-session encryption.
> Developers
> will develop better application if they consider how salt could be used.
> Therefore,
> salt is better to be required parameter and omit it only when salt cannot

be used.=E2=80=8B
>
>
=E2=80=8B---=E2=80=8B

One such real-world use case: Defuse v1 used HKDF without a salt.

https://github.com/defuse/php-encryption/blob/b87737b2eec06b13f025cabea8473=
38fa203d1b4/Crypto.php#L157-L170
https://github.com/defuse/php-encryption/blob/b87737b2eec06b13f025cabea8473=
38fa203d1b4/Crypto.php#L358

In version 2, we included a 32-byte random salt for each encryption, which
was stored next to the AES-256-CTR nonce in the ciphertext. (Both the nonce
and HKDF-salt, as well as the version information header, are covered by
the HMAC of the ciphertext.)

The end result: Instead of having to worry about birthday collisions after
you've seen 2^64 AES outputs (because 128-bit randomly generated nonce),
now you need 2^192 before you have a useful collision.

Although the RFC itself says that salts are optional, the argument to make
them required in PHP's implementation has merit. The only downside is: If
you're integrating with an implementation that doesn't require salts, and
the application doesn't use salts, you're out of luck. Is that enough of a
downside to dismiss an argument for better security? Maybe.

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com/>=E2=80=8B

--94eb2c1922160633080547f68153--