Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:98258
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 74.125.82.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAKws9z31kvAs16kU1QBfdTP+G0d21PYcRaCw2-8rdsZpsRxkFg@mail.gmail.com>
References: <CAGa2bXZWKqJpvWma1zdY8j+yFg-pMXBZZHpUHb=KhJQucCf+9Q@mail.gmail.com>
 <CAKws9z31kvAs16kU1QBfdTP+G0d21PYcRaCw2-8rdsZpsRxkFg@mail.gmail.com>
Date: Wed, 8 Feb 2017 13:27:22 +0200
Message-ID: <CAPhkiZzO_B5OZExTYGpwk1oBEb=J4Mvw3DYJznU3+etwSuxqsw@mail.gmail.com>
To: Scott Arciszewski <scott@paragonie.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>, 
	Nikita Popov <nikita.ppv@gmail.com>
Content-Type: multipart/alternative; boundary=001a113e026cfdddf405480325c6
Subject: Re: [PHP-DEV] hash_hkdf() signature
From: narf@devilix.net (Andrey Andreev)

--001a113e026cfdddf405480325c6
Content-Type: text/plain; charset=UTF-8

Hi,

On Tue, Feb 7, 2017 at 10:22 PM, Scott Arciszewski <scott@paragonie.com>
wrote:

>
>
> Although the RFC itself says that salts are optional, the argument to make
> them required in PHP's implementation has merit. The only downside is: If
> you're integrating with an implementation that doesn't require salts, and
> the application doesn't use salts, you're out of luck. Is that enough of a
> downside to dismiss an argument for better security? Maybe.
>
>
I said this in another thread already, but I'll re-iterate here ... Using a
salt should be recommended, but the suggestion here takes that out of
context and misses a key point - that the Length and Info params are not of
any less importance overall.

- Length is effectively the key size and is in fact not optional in
RFC5869*. You have to really know what you're doing if you don't use it,
and choose the hash function very carefully. I'd argue that if you know
this well enough, you'd also know what to do with Salt.
- Info is technically optional, but pretty much the feature why you'd
choose HKDF over other KDFs. It's what makes HKDF's more useful in that it
enables derivation of multiple OKMs from a single IKM. If you don't need
Info, chances are you don't need HKDF.

One could use Salt for the purposes of Info, but that would be misusing the
algorithm.
Over-focusing on Section 3.1 of the specification, while at the same time
ignoring Section 3.2 - arbitrarily making OptionalParamX mandatory because
the note about it mentions the word "security". Noble, but misguided.

I'd have no problem if ALL of the params were made non-optional - I'm all
for that, but either do that or leave it untouched.

* RFC 5869: https://tools.ietf.org/html/rfc5869

Cheers,
Andrey.

--001a113e026cfdddf405480325c6--