Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure:

  • Using PBKDF2 with then entire 128 bit random salt and generating 512 bits of derived data to split into a 256 bit AES Key and a 256 bit HMAC key.


  • Using PBKDF2 separately for each key using two 64 bits salts to generate a 256 bit AES Key and a 256 bit HMAC key.


  • Better option?
share|improve this question

1 Answer 1

up vote 7 down vote accepted

I'd use HKDF's "expand" step to generate multiple keys from one masterkey.

Use PBKDF2 to derive that masterkey from the password and salt. i.e. replace the "extract" step of HKDF with PBKDF2.

MasterKey = PBKDF2(salt, password, iterations)

AES-Key = HMAC(MasterKey, "AES-Key" | 0x01)
MAC-Key = HMAC(MasterKey, "MAC-Key" | 0x01)

(where | denotes concatenation)

Having PBKDF2 output more than its native size is a bad idea IMO. It increases the cost for the defender considerably (multiple key derivations with thousands of iterations) but doesn't increase the cost for the attacker(he can verify correctness of his password guess after one key was derived, he doesn't need both).

If you use a 512 bit hash, such as SHA-512 in PBKDF2 (PBKDF2-HMAC-SHA-512) you can also get away with simply splitting those 512 bits into two parts, using one for encryption and the other for MAC. But IMO the HKDF approach is cleaner.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.