I have a key that is the combination of two shorter keys generated by PBKDF2, which together are long more or less 64 bytes. Now I need to shrink it down to 32 bytes and I'm not sure what to use to do it. I was thinking of SHA256. I know that SHA256 is not safe to generate keys by itself, but since what I have is a combination of two proper generated keys, then SHA256 would be just fine. Am I right or I should use something else to accomplish this goal?
$\begingroup$
$\endgroup$
6
-
2$\begingroup$ No objection... $\endgroup$– fgrieu ♦Jul 3, 2014 at 17:32
-
$\begingroup$ Since you have PBKDF2, you can also just do one iteration of that using both the keys as input, and the specified length as output. But SHA-256 works too. $\endgroup$– Stephen TousetJul 3, 2014 at 17:44
-
$\begingroup$ You haven't said what your use is, but there are better and newer hash algorithms available that aren't written by the NSA - Skein and Keccak come to mind. Use the 256 bit variant of them instead. $\endgroup$– NDF1Jul 4, 2014 at 4:27
-
2$\begingroup$ Skein and Keccak do not have the thirteen years of cryptanalysis that SHA-256 has. There is little compelling reason to choose one of them over SHA-256 at the current time. There is no need to search for the NSA hiding under every rock. $\endgroup$– Stephen TousetJul 4, 2014 at 16:37
-
$\begingroup$ Do you work for the NSA Stephen? When using an algorithm from an author it requires a fair amount of trust in their work. When that author has been shown to be backdooring and weakening crypto standards (Dual EC DRBG and more) also their game plan to do exactly this in leaked documents then it's a fair assumption their other work may contain issues. For instance, where is the design document for how SHA2 was designed and the reasons for decisions made, e.g. choice of IVs etc? If I read the specs for Skein and Keccak they detail their decision making process and reasons for every small detail. $\endgroup$– NDF1Jul 5, 2014 at 8:31
|
Show 1 more comment
1 Answer
$\begingroup$
$\endgroup$
I agree with the comments that SHA-256 should be fine here.
However, if you already use HMAC-SHA-256 for PBKDF2, you could use HKDF Expand, which despite its name is defined even for output lengths shorter than input. In your case the output would be simply:
$$\operatorname{HMAC-SHA-256}(\text{key}, \text{info} || \text{0x01}),$$
where 'info' is an optional, arbitrary string to specify this particular key in case you ever need to derive another key from the same material and '0x01' is the byte with value 1.
