Re: hash_hkdf() signature

On 2/7/17 3:22 PM, Scott Arciszewski wrote:

One such real-world use case: Defuse v1 used HKDF without a salt. https://github.com/defuse/php-encryption/blob/b87737b2eec06b13f025cabea847338fa203d1b4/Crypto.php#L157-L170 https://github.com/defuse/php-encryption/blob/b87737b2eec06b13f025cabea847338fa203d1b4/Crypto.php#L358 In version 2, we included a 32-byte random salt for each encryption, which was stored next to the AES-256-CTR nonce in the ciphertext. (Both the nonce and HKDF-salt, as well as the version information header, are covered by the HMAC of the ciphertext.) The end result: Instead of having to worry about birthday collisions after you've seen 2^64 AES outputs (because 128-bit randomly generated nonce), now you need 2^192 before you have a useful collision.

In this situation shouldn't you either use a longer random IKM or not use HKDF at all? If your IKM is so weak that it needs a salt then shouldn't you use an iterated hash instead of HKDF? Tom