Consider generating a random salt every time you encrypt data.
That way, you can use HKDF to derive a new cipherkey, mackey and iv from the master key. Then, just pass the salt with the ciphertext instead of the iv (since you can regenerate the IV).
For example:
$salt = self::getRandomBytes(16, true);
$cipherKey = self::hkdf($this->masterKey, 'sha512', 32, 'cipherkey', $salt);
$macKey = self::hkdf($this->masterKey, 'sha512', 32, 'mackey', $salt);
$iv = self::hkdf($this->masterKey, 'sha512', 16, 'iv', $salt);
That way, you don't run into CTR key rotation issues with generation of 2^64 plain texts with the same cipher key (since every encryption here uses a unique cipherkey).
Consider generating a random salt every time you encrypt data.
That way, you can use HKDF to derive a new cipherkey, mackey and iv from the master key. Then, just pass the salt with the ciphertext instead of the iv (since you can regenerate the IV).
For example:
That way, you don't run into CTR key rotation issues with generation of 2^64 plain texts with the same cipher key (since every encryption here uses a unique cipherkey).