# Derive both MAC and AES keys from same PBKDF2?

When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be created using a different salt or iteration count, for each?)

This answer seems to say this isn't a good idea. While this one seems to say it is. Am I misunderstanding one of them? (Or both.)

(And by the way, the first is marked as a duplicate of a question which deals with an initially strong key, while it itself deals with a simple passphrase.)

-
You should avoid deriving more than the natural output size direclty PBKDF2. With PBKDF2-HMAC-SHA512 that's enough for two keys, with *-SHA1 it isn't. If you need more key material, use HKDF-Expand on the output of PBKDF2. –  CodesInChaos Jan 29 at 20:34
@CodesInChaos From the second link: PBKDF2 supports the generation of arbitrary amounts of key data. (I'm using Rfc2898DeriveBytes if it matters.) –  ispiro Jan 29 at 20:38
It can, but when you do it might be possible for the attacker to compute it more cheaply than for the defender, since the defender needs the whole output, whereas the attacker might be able to confirm it with only part of the output. This shouldn't happen with well designed password based key derivation functions, but PBKDF2 is not one of those. –  CodesInChaos Jan 29 at 20:53
@CodesInChaos Thanks. Is there any .net implementation of HKDF (or better yet, of a well designed password based key derivation functions)? –  ispiro Jan 29 at 21:02
Consider scrypt instead of PBKDF2, it handles this very well. There is no “natural output size,” AFAIK. If you want two 256-bit keys, use 512 as the length argument and use bits 0-255 and 256-511 as the two keys. –  myfreeweb Mar 2 at 21:44

From a practical point of view, deriving lots of key material using PBKDF2 is inefficient (in the sense that to generate $n$ blocks and increase the adversary's work by $t$, you do work $nt$, instead of $n+t$).
A more practical solution uses PBKDF2 to generate a short string and a suitable generator (probably HMAC-based) to produce lots of key material. Typically: $$k_0 \leftarrow PBKDF2(pw, \dots)$$ $$\text{key material} \leftarrow HMAC(k_0, 1) || HMAC(k_0, 2) || HMAC(k_0, 3) || ...$$