Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a key that is the combination of two shorter keys generated by PBKDF2, which together are long more or less 64 bytes. Now I need to shrink it down to 32 bytes and I'm not sure what to use to do it. I was thinking of SHA256. I know that SHA256 is not safe to generate keys by itself, but since what I have is a combination of two proper generated keys, then SHA256 would be just fine. Am I right or I should use something else to accomplish this goal?

share|improve this question
No objection... – fgrieu Jul 3 '14 at 17:32
Since you have PBKDF2, you can also just do one iteration of that using both the keys as input, and the specified length as output. But SHA-256 works too. – Stephen Touset Jul 3 '14 at 17:44
You haven't said what your use is, but there are better and newer hash algorithms available that aren't written by the NSA - Skein and Keccak come to mind. Use the 256 bit variant of them instead. – NDF1 Jul 4 '14 at 4:27
Skein and Keccak do not have the thirteen years of cryptanalysis that SHA-256 has. There is little compelling reason to choose one of them over SHA-256 at the current time. There is no need to search for the NSA hiding under every rock. – Stephen Touset Jul 4 '14 at 16:37
Do you work for the NSA Stephen? When using an algorithm from an author it requires a fair amount of trust in their work. When that author has been shown to be backdooring and weakening crypto standards (Dual EC DRBG and more) also their game plan to do exactly this in leaked documents then it's a fair assumption their other work may contain issues. For instance, where is the design document for how SHA2 was designed and the reasons for decisions made, e.g. choice of IVs etc? If I read the specs for Skein and Keccak they detail their decision making process and reasons for every small detail. – NDF1 Jul 5 '14 at 8:31
up vote 5 down vote accepted

I agree with the comments that SHA-256 should be fine here.

However, if you already use HMAC-SHA-256 for PBKDF2, you could use HKDF Expand, which despite its name is defined even for output lengths shorter than input. In your case the output would be simply:

$$\operatorname{HMAC-SHA-256}(\text{key}, \text{info} || \text{0x01}),$$

where 'info' is an optional, arbitrary string to specify this particular key in case you ever need to derive another key from the same material and '0x01' is the byte with value 1.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.