title: Password hashing security
body: <p>I have a few questions concerning password hashing. I found hash_hmac a pretty good function to hash passwords but a few questions remain.</p>
  
  <p>From another stackoverflow questions someone responded with:</p>
  
  <pre><code>return hash_hmac('sha512', $salt . $user['password'], $this-&gt;site_key);
  </code></pre>
  
  <p>My initial question concerns how hmac uses the key, on wikipedia it seems that the hmac function would prepend the key to every piece of message before hashing it, does the key itself not act as a salt then? Can I then drop the $salt and just use a user specific key instead? <code>hash_hmac('sha512', $user['password'], $this-&gt;user_key)</code></p>
  
  <p>The big question remains the generating of the $salt (or the $user_key from first question). I don't like to store the used salt in the database if I would generate them using rand(). What would then be a good way to generate a user specific salt?</p>
  
  <p><strong>Update</strong></p>
  
  <p>If I <em>would</em> store the salt in the database, is it safe to use:</p>
  
  <pre><code>$user_key = $user['salt'] . $this-&gt;site_key;
  return hash_hmac('sha512', $user['password'], $user_key);
  </code></pre>