Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:98264
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain paragonie.com designates 209.85.218.44 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAPhkiZzO_B5OZExTYGpwk1oBEb=J4Mvw3DYJznU3+etwSuxqsw@mail.gmail.com>
References: <CAGa2bXZWKqJpvWma1zdY8j+yFg-pMXBZZHpUHb=KhJQucCf+9Q@mail.gmail.com>
 <CAKws9z31kvAs16kU1QBfdTP+G0d21PYcRaCw2-8rdsZpsRxkFg@mail.gmail.com> <CAPhkiZzO_B5OZExTYGpwk1oBEb=J4Mvw3DYJznU3+etwSuxqsw@mail.gmail.com>
Date: Wed, 8 Feb 2017 09:22:34 -0500
Message-ID: <CAKws9z3oOuPjLutsYNfOVToMMZTfKK_o5FEpVLr6PNKyQ3YXBg@mail.gmail.com>
To: Andrey Andreev <narf@devilix.net>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>, 
	Nikita Popov <nikita.ppv@gmail.com>
Content-Type: multipart/alternative; boundary=001a1134fa548bbfa10548059838
Subject: Re: [PHP-DEV] hash_hkdf() signature
From: scott@paragonie.com (Scott Arciszewski)

--001a1134fa548bbfa10548059838
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Feb 8, 2017 at 4:16 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi Scott,
>
> There are applications that do not require salt. In this case, all users
> has to do is
> $salt =3D NULL
> to omit $salt.
>


Great.

On Wed, Feb 8, 2017 at 6:27 AM, Andrey Andreev <narf@devilix.net> wrote:

> Hi,
>
> On Tue, Feb 7, 2017 at 10:22 PM, Scott Arciszewski <scott@paragonie.com>
> wrote:
>
>>
>>
>> Although the RFC itself says that salts are optional, the argument to
>> make them required in PHP's implementation has merit. The only downside =
is:
>> If you're integrating with an implementation that doesn't require salts,
>> and the application doesn't use salts, you're out of luck. Is that enoug=
h
>> of a downside to dismiss an argument for better security? Maybe.
>>
>>
> I said this in another thread already, but I'll re-iterate here ... Using
> a salt should be recommended, but the suggestion here takes that out of
> context and misses a key point - that the Length and Info params are not =
of
> any less importance overall.
>
> - Length is effectively the key size and is in fact not optional in
> RFC5869*. You have to really know what you're doing if you don't use it,
> and choose the hash function very carefully. I'd argue that if you know
> this well enough, you'd also know what to do with Salt.
> - Info is technically optional, but pretty much the feature why you'd
> choose HKDF over other KDFs. It's what makes HKDF's more useful in that i=
t
> enables derivation of multiple OKMs from a single IKM. If you don't need
> Info, chances are you don't need HKDF.
>
> One could use Salt for the purposes of Info, but that would be misusing
> the algorithm.
> Over-focusing on Section 3.1 of the specification, while at the same time
> ignoring Section 3.2 - arbitrarily making OptionalParamX mandatory becaus=
e
> the note about it mentions the word "security". Noble, but misguided.
>
> I'd have no problem if ALL of the params were made non-optional - I'm all
> for that, but either do that or leave it untouched.
>
> * RFC 5869: https://tools.ietf.org/html/rfc5869
>
> Cheers,
> Andrey.
>


Given everything discussed in this sub-thread so far, =E2=80=8BI would be i=
n favor
of making everything non-optional.

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com/>=E2=80=8B

--001a1134fa548bbfa10548059838--