Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be created using a different salt or iteration count, for each?)

This answer seems to say this isn't a good idea. While this one seems to say it is. Am I misunderstanding one of them? (Or both.)

(And by the way, the first is marked as a duplicate of a question which deals with an initially strong key, while it itself deals with a simple passphrase.)

share|improve this question
You should avoid deriving more than the natural output size direclty PBKDF2. With PBKDF2-HMAC-SHA512 that's enough for two keys, with *-SHA1 it isn't. If you need more key material, use HKDF-Expand on the output of PBKDF2. – CodesInChaos Jan 29 '14 at 20:34
@CodesInChaos From the second link: PBKDF2 supports the generation of arbitrary amounts of key data. (I'm using Rfc2898DeriveBytes if it matters.) – ispiro Jan 29 '14 at 20:38
It can, but when you do it might be possible for the attacker to compute it more cheaply than for the defender, since the defender needs the whole output, whereas the attacker might be able to confirm it with only part of the output. This shouldn't happen with well designed password based key derivation functions, but PBKDF2 is not one of those. – CodesInChaos Jan 29 '14 at 20:53
@CodesInChaos Thanks. Is there any .net implementation of HKDF (or better yet, of a well designed password based key derivation functions)? – ispiro Jan 29 '14 at 21:02
Consider scrypt instead of PBKDF2, it handles this very well. There is no “natural output size,” AFAIK. If you want two 256-bit keys, use 512 as the length argument and use bits 0-255 and 256-511 as the two keys. – myfreeweb Mar 2 '14 at 21:44

From a security point of view, deriving lots of key material using PBKDF2 is ok.

From a practical point of view, deriving lots of key material using PBKDF2 is inefficient (in the sense that to generate $n$ blocks and increase the adversary's work by $t$, you do work $nt$, instead of $n+t$).

A more practical solution uses PBKDF2 to generate a short string and a suitable generator (probably HMAC-based) to produce lots of key material. Typically: $$k_0 \leftarrow PBKDF2(pw, \dots)$$ $$\text{key material} \leftarrow HMAC(k_0, 1) || HMAC(k_0, 2) || HMAC(k_0, 3) || ...$$

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.