Making people call them themselves is dumb, totally agreed, they should
probably be seperate functions though because well-factored software or
something.


On Tue, Jan 21, 2014 at 1:47 PM, David Reid <notifications@github.com>wrote:

> In cryptography/hazmat/primitives/kdf/hkdf.py:
>
> > +from cryptography.hazmat.primitives import hashes
> > +from cryptography.hazmat.primitives import constant_time
> > +
> > +def hkdf_derive(input_key, key_length, salt, info, hash, backend):
> > +    if hash is None:
> > +        hash = hashes.SHA256()
> > +
> > +    if info is None:
> > +        info = b""
> > +
> > +    if salt is None:
> > +        salt = b"\x00" * (hash.digest_size // 8)
> > +
> > +    h = hmac.HMAC(salt, hash, backend=backend)
> > +    h.update(input_key)
> > +    PRK = h.finalize()
>
> Making people extract and extend themselves is kind of dumb.
>
> Is there any legitimate use case for handling the intermediate material
> (PRK)?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/490/files#r9051295>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084