diff --git a/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php
index 9714106..801ad36 100644
--- a/core/lib/Drupal/Core/DrupalKernel.php
+++ b/core/lib/Drupal/Core/DrupalKernel.php
@@ -253,7 +253,7 @@ public static function createFromRequest(Request $request, $class_loader, $envir
         && Settings::get('class_loader_auto_detect', TRUE)
         && Settings::get('hash_salt', FALSE)
         && function_exists('apc_fetch')) {
-      $prefix = 'drupal.' . hash('sha256', 'drupal.' . Settings::getHashSalt());
+      $prefix = static::getApcKey('class_loader');
       $apc_loader = new \Symfony\Component\ClassLoader\ApcClassLoader($prefix, $class_loader);
       $class_loader->unregister();
       $apc_loader->register();
@@ -431,7 +431,7 @@ public function boot() {
       }
     }
     FileCacheFactory::setConfiguration($configuration);
-    FileCacheFactory::setPrefix(hash('sha256', 'FileCache' . Settings::get('hash_salt')));
+    FileCacheFactory::setPrefix(static::getApcKey('file_cache'));
 
     // Initialize the container.
     $this->initializeContainer();
@@ -1359,4 +1359,17 @@ protected function addServiceFiles($service_yamls) {
     }
     return FALSE;
   }
+
+  /**
+   * Generates a cache for use in the APC cache.
+   *
+   * @param string $cid
+   *   The cache ID of the data to retrieve.
+   */
+  protected static function getApcKey($cid) {
+    // @todo: This should be using Settings::getHashSalt().
+    // @see https://www.drupal.org/node/2474077
+    return 'drupal.' . $cid . hash_hmac('sha256', $cid, Settings::get('hash_salt'));
+  }
+
 }
diff --git a/core/lib/Drupal/Core/Session/PermissionsHashGenerator.php b/core/lib/Drupal/Core/Session/PermissionsHashGenerator.php
index f176afd..2df7759 100644
--- a/core/lib/Drupal/Core/Session/PermissionsHashGenerator.php
+++ b/core/lib/Drupal/Core/Session/PermissionsHashGenerator.php
@@ -83,7 +83,7 @@ protected function doGenerate(array $roles) {
       sort($permissions);
       $permissions_by_role[$role] = $permissions;
     }
-    return hash('sha256', $this->privateKey->get() . Settings::getHashSalt() . serialize($permissions_by_role));
+    return hash_hmac('sha256', serialize($permissions_by_role), $this->privateKey->get() . Settings::getHashSalt());
   }
 
 }
diff --git a/sites/default/default.settings.php b/sites/default/default.settings.php
index 3783d0a..7edb11f 100644
--- a/sites/default/default.settings.php
+++ b/sites/default/default.settings.php
@@ -403,7 +403,7 @@
  */
 /*
 if ($settings['hash_salt']) {
-  $prefix = 'drupal.' . hash('sha256', 'drupal.' . $settings['hash_salt']);
+  $prefix = 'drupal.' . hash_hmac('sha256', 'drupal', $settings['hash_salt']);
   $apc_loader = new \Symfony\Component\ClassLoader\ApcClassLoader($prefix, $class_loader);
   unset($prefix);
   $class_loader->unregister();