Newsgroups: php.doc,php.internals
Path: news.php.net
Xref: news.php.net php.doc:969386562 php.internals:98850
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.219 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXa+wfcVbeX32t8kOiL7Bz1dBnvwweSwoLETpEiw=rTyoA@mail.gmail.com>
References: <CAGa2bXbUYDgJxmmZfuS5ZbWCLjq0QPpDioM-zkU9j7EHA-D_ag@mail.gmail.com>
 <CAGa2bXYFw6Uz9cLFM1QT9ULak9uJcM4mr0R59TEa0eYf-tAm+Q@mail.gmail.com>
 <CAGa2bXYnDgvsWi4kCdajnnQ-psCPThpLu3_EK_DprLWsX+UZ2A@mail.gmail.com>
 <CAL=_i_n4KSfx=TGMjTnjjszaNzVqT=V=GPZFyiLYFuzb8RxCgQ@mail.gmail.com>
 <CAGa2bXZ6JMKWsY=Cea-=V=g09jdTQGDOg7TtJrf6_higU0KW3Q@mail.gmail.com>
 <1924612862.1298112.1492071094545.JavaMail.zimbra@pieterhordijk.com>
 <CAGa2bXYR5ssff9YXUYGcsriTWJfYEf-2OkTXAxnb536HPhBjpA@mail.gmail.com>
 <CAF+90c81-1gA9-3UfwN6ohcu587He22wN9ekMiDsbNkyYmmZmw@mail.gmail.com>
 <690015854.1384408.1492163148986.JavaMail.zimbra@pieterhordijk.com>
 <CAGa2bXY2kwasyH4GwoSfSr6XcMcg1jukcMXOEUPvBg8pLCbDkg@mail.gmail.com> <CAGa2bXa+wfcVbeX32t8kOiL7Bz1dBnvwweSwoLETpEiw=rTyoA@mail.gmail.com>
Date: Sat, 22 Apr 2017 21:32:01 +0200
Message-ID: <CANUQDCgHLQVzY08CtS_QA6vsao+hpejKGAuyB1eETEcEmpcxhg@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Pieter Hordijk <info@pieterhordijk.com>, Joe Watkins <pthreads@pthreads.org>, 
	Andrey Andreev <narf@devilix.net>, internals <internals@lists.php.net>, 
	phpdoc <phpdoc@lists.php.net>, Nikita Popov <nikita.ppv@gmail.com>
Content-Type: multipart/alternative; boundary=001a1136e4c2a89551054dc66d3d
Subject: Re: [PHP-DEV] [RFC][VOTE] Improve hash_hkdf() parameter
From: me@kelunik.com (Niklas Keller)

--001a1136e4c2a89551054dc66d3d
Content-Type: text/plain; charset=UTF-8

2017-04-22 21:14 GMT+02:00 Yasuo Ohgaki <yohgaki@ohgaki.net>:

> Hi all,
>
> On Sat, Apr 15, 2017 at 9:17 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
> > My opinions are either based on concrete logic or
> > recommendations based reliable sources.
> >
> > I improved hash_hkdf() manual farther more based on RFC 5869
> descriptions.
> > https://gist.github.com/anonymous/ace4fa267f20041676f265fe58c3f1ea
> >
> > Please verify it again.
> >
>
> I would like to finish documentation.
>
> RFC 5869 clearly states HKDF is a generic key derivation function.
>
> Omitting salt when key does not have enough entropy is obvious
> bad practice or mistake. Even when key has enough entropy, long
> life key (IKM) requires good salt for the best key security. These
> could be understood from the RFC and other basic crypt theory.
>
> I'll commit the doc in a few days if there is no more comments on this.
>

What the... there were multiple concerns regarding the changes already. I'm
hereby expressing another strong -1 on these.

Regards, Niklas


> Andrey, (Or anyone who vote no for the PHP RFC)
>
> Could you show some good example hash_hkdf() usages that justify
> current function signature? I suppose you should have few common and
> good examples.
>
> I cannot think of any common/good example that uses length only or
> length/info only. No good example is shown so far.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>

--001a1136e4c2a89551054dc66d3d--