Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:98276
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAKws9z1iOXvvvLAc79JmYNgkuhu-=0QKs46DUZS7p7h9y8fx5Q@mail.gmail.com>
References: <CAGa2bXZWKqJpvWma1zdY8j+yFg-pMXBZZHpUHb=KhJQucCf+9Q@mail.gmail.com>
 <CAKws9z31kvAs16kU1QBfdTP+G0d21PYcRaCw2-8rdsZpsRxkFg@mail.gmail.com>
 <CAPhkiZzO_B5OZExTYGpwk1oBEb=J4Mvw3DYJznU3+etwSuxqsw@mail.gmail.com>
 <CAKws9z3oOuPjLutsYNfOVToMMZTfKK_o5FEpVLr6PNKyQ3YXBg@mail.gmail.com>
 <CAGa2bXa-cxxOqB__E17QTA4czp-PsaqT5DaWBm=F_+=x=QLzCw@mail.gmail.com>
 <CAPhkiZyeYiZ4r5Rt679Q7VOeNFYteAQRR9U7D_Oo=O7Xwv4oGw@mail.gmail.com>
 <CAGa2bXb2VHO6hxNut3mLSmEOn1iTmVZAJ-vE2XxTafPLASJ8Cw@mail.gmail.com> <CAKws9z1iOXvvvLAc79JmYNgkuhu-=0QKs46DUZS7p7h9y8fx5Q@mail.gmail.com>
Date: Fri, 10 Feb 2017 11:37:04 +0900
Message-ID: <CAGa2bXZKwVdAjLvYdfve=d9HGuP+Fi0c2+zSRfS5-oq8tm9eFQ@mail.gmail.com>
To: Scott Arciszewski <scott@paragonie.com>
Cc: Andrey Andreev <narf@devilix.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113f443488fcc5054823fb03
Subject: Re: [PHP-DEV] hash_hkdf() signature
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a113f443488fcc5054823fb03
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Scott and all,

On Thu, Feb 9, 2017 at 10:52 PM, Scott Arciszewski <scott@paragonie.com>
wrote:

>
> =E2=80=8B
>> =E2=80=8BHKDF relies on PRK being cryptographically strong.
>> =E2=80=8B
>> =E2=80=8B
>
>
>
> =E2=80=8BYes, b=E2=80=8But not for the reasons you might suspect.
>
> =E2=80=8BThe main use case of HKDF is to completely prevent related-key a=
ttacks,
> while splitting a single key into several for domain-specific purposes.=
=E2=80=8B
> Figuring out a subkey (by sheer luck) should also not give an attacker
> enough information to recreate the IKM.
>
> HKDF isn't meant for key stretching (e.g. use an 80-bit secret in an
> application that requires a 256-bit secret). That's what a password hashi=
ng
> function is for. (Bcrypt, Argon2, etc.)
>
> =E2=80=8B
>> =E2=80=8BYou should understand users _must_ make sure either "salt" or "=
IKM" is
>
> strong for HKDF to work. Since hash_hkdf() is generic function, you never
>
> can make sure IKM to be strong always.=E2=80=8B
>
> =E2=80=8B=E2=80=8B
>
> Not quite. IKM has to be strong. The salt? Not so much.
>
> In cryptography protocols, salts are considered public information (even
> if you don't go out of your way to publish it).
>
> If you have a weak IKM but a strong salt (32 bytes from random_bytes()),
> you should still consider the OKM weak.
> =E2=80=8B
>
>> Salt is the most important for both input and output key security.
>> Salt is mandatory and/or can be used for almost always with PHP.
>> Salt usage results in better design/security.
>> Salt is often used as final key as combined key.
>
>
>
> Don't get me wrong: Having secure random salts is useful (serves as a
> useful way to enlarge the effective nonce in a symmetric encryption
> protocol).
>
> But the cryptographic secret in this protocol is IKM. Not the salt.
>

I agree that your description matches many typical crypto
encryptions/authentication/etc.
As you would know, there are some exceptions that encryption key is not
really a random
(Not cryptographically strong) If user could use strong IKM, they should
use it, then
salt could be for additional security. (HKDF IKM could be weak, salt could
be secret, but
you mentioned typical use case and best practice in crypto)

The most typical HKDF application with PHP is access token key derivations
with timestamp
such as CSRF and Object Access token. For these applications, salt usage is
strongly
recommended, info(context) is recommended, length is OK with hash default.

e.g.
Generating CSRF token keys
$expire =3D time()+900; // Even, non secret, low entropy salt makes HKDF OK=
M
significantly stronger.
$csrf_token =3D bin2hex(hash_hkdf('sha256', $_SESSION['CSRF_TOKEN_SEED'], 0=
,
'', $expire));
then, send $expire and $csrf_token as access key.

This could be done with hash_hmac() already.
$csrf_token =3D hash_hmac('sha256', $_SESSION['CSRF_TOKEN_SEED'], $expire))=
;

What's really good about HKDF is it can add additional non secret optional
context(domain) safely, as you mentioned.
// Make CSRF token only valid to 'Admin' features.
$csrf_token =3D bin2hex(hash_hkdf('sha256', $_SESSION['CSRF_TOKEN_SEED'], 0=
,
'Admin', $expire));
// Should be OK, but this is risky compare to above.
$csrf_token =3D hash_hmac('sha256', $_SESSION['CSRF_TOKEN_SEED'], $expire.
'-Admin'));

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a113f443488fcc5054823fb03--