Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
Strongly suggest: Not doing HMAC.

Instead, use [HKDF](https://tools.ietf.org/html/rfc5869). HMAC is not a key derivation strategy, it's a authentication code strategy. It can be used to derive keys, but with more logic (which is what HKDF does).