Re: internals Digest 3 Feb 2017 23:56:52 -0000 Issue 4435
| From: | Yasuo Ohgaki | Date: | Sat, 04 Feb 2017 21:02:39 +0000 |
| Subject: | Re: internals Digest 3 Feb 2017 23:56:52 -0000 Issue 4435 | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-98198@lists.php.net to get a copy of this message | ||
On Sun, Feb 5, 2017 at 5:27 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> 2) Use 1) as ikm and "salt" to generate key (NOTE: One of the best place
> for salt storage is $_ENV)
BTW, better place to keep these secret values is to set key management
server
and get key from it. Secure the key management server and communication to
it
as much as possible.
Those who are really care about security should use key management server.
And don't forget to use salt with HKDF, it should be optional only if salt
cannot be
used. Before omitting "salt" for HKDF, one should consider how it can be
set.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net