Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:98775
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain pthreads.org from 209.85.128.172 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYnDgvsWi4kCdajnnQ-psCPThpLu3_EK_DprLWsX+UZ2A@mail.gmail.com>
References: <CAGa2bXbUYDgJxmmZfuS5ZbWCLjq0QPpDioM-zkU9j7EHA-D_ag@mail.gmail.com>
 <CAGa2bXZ9_DtktnGpX38DHUvEzU4=9wMc_23fKxudzZWZ49A+Hw@mail.gmail.com>
 <0285A0ED-A39F-46C9-A927-3C786F2B256D@koalephant.com> <CAGa2bXYFw6Uz9cLFM1QT9ULak9uJcM4mr0R59TEa0eYf-tAm+Q@mail.gmail.com>
 <CAGa2bXYnDgvsWi4kCdajnnQ-psCPThpLu3_EK_DprLWsX+UZ2A@mail.gmail.com>
Date: Wed, 12 Apr 2017 11:46:51 +0100
Message-ID: <CAL=_i_n4KSfx=TGMjTnjjszaNzVqT=V=GPZFyiLYFuzb8RxCgQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Stephen Reay <php-lists@koalephant.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f403045f12be15d874054cf5ed64
Subject: Re: [PHP-DEV] [RFC][VOTE] Improve hash_hkdf() parameter
From: pthreads@pthreads.org (Joe Watkins)

--f403045f12be15d874054cf5ed64
Content-Type: text/plain; charset=UTF-8

Morning,

This RFC was left open for 5 days past the end of voting as declared on the
RFC.

I have closed the vote, and moved it out of voting section on RFC index.

Cheers
Joe

On Sat, Apr 1, 2017 at 3:50 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
>   - insecure signature (it ignores strong RFC 5689 recommendation)
> s/RFC 5689/RFC 5869/
>
> On Sat, Apr 1, 2017 at 11:27 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
> >
> > Given that the function is live in the wild, massively changing the order
> >> of things and defaults is an instant red flag for myself, and I believe
> a
> >> lot of other people.
> >>
> >
> > Aside from it should not be merged into PHP 7.1 in the first place.
> > There are only 2 (or 3) bug fix versions released. Fixing mistake ASAP is
> > better. IMHO.
> >
> >
> > To me this sounds more like an issue that could be relatively quickly
> >> improved by a documentation update that highlights how to securely use
> the
> >> function.
> >>
> >
> > While documentation may work, it seems silly for me to write,
> >
> >   Even if "salt" is the last optional parameter, users must set
> > appropriate "salt" whenever it is possible for maximum key security.
> >
>
> Another possible resolution could be reverting hash_hkdf() merge from 7.1
> branch.
> Basic hash_hkdf() operation could be done by hash_hmac() easily.
>
> The merge should have had PHP RFC.
> Reverting hash_hkdf() merge may work better.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>

--f403045f12be15d874054cf5ed64--