Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:98641 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 76173 invoked from network); 27 Mar 2017 04:09:30 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 27 Mar 2017 04:09:30 -0000 Authentication-Results: pb1.pair.com header.from=php-lists@koalephant.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=php-lists@koalephant.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain koalephant.com designates 206.123.115.54 as permitted sender) X-PHP-List-Original-Sender: php-lists@koalephant.com X-Host-Fingerprint: 206.123.115.54 mail1.25mail.st Received: from [206.123.115.54] ([206.123.115.54:35596] helo=mail1.25mail.st) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id BC/A3-33481-67098D85 for ; Sun, 26 Mar 2017 23:09:29 -0500 Received: from [10.0.1.63] (unknown [183.89.40.226]) by mail1.25mail.st (Postfix) with ESMTPSA id 276536046D; Mon, 27 Mar 2017 04:09:17 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) In-Reply-To: Date: Mon, 27 Mar 2017 11:09:15 +0700 Cc: "internals@lists.php.net" Content-Transfer-Encoding: quoted-printable Message-ID: <0285A0ED-A39F-46C9-A927-3C786F2B256D@koalephant.com> References: To: Yasuo Ohgaki X-Mailer: Apple Mail (2.3124) Subject: Re: [PHP-DEV] [RFC][VOTE] Improve hash_hkdf() parameter From: php-lists@koalephant.com (Stephen Reay) >=20 > I'll try to explain a bit more by examples. >=20 Hi Yasuo, It sounds to me like it is *possible* to currently use hash_hkdf() in a = secure manner, but that you (and some others?) feel the arg order and = default args are not conducive to safe/secure usage. Given that the function is live in the wild, massively changing the = order of things and defaults is an instant red flag for myself, and I = believe a lot of other people. To me this sounds more like an issue that could be relatively quickly = improved by a documentation update that highlights how to securely use = the function. Yes, if there are more secure defaults that would be nice, but that ship = has sailed, and the function was on it. Just my 2 cents. Cheers Stephen=