New answers tagged key-derivation
It is secure. The IV only needs to be indistinguishable from random to an attacker, and it is as long as the salt is random. There is one remark: if you extract more key + iv bytes than the hash function in PBKDF2 returns then the PBKDF2 function is executed twice. An attacker however only has to find the key, not the IV, so an attacker doesn't have to do ...
Sure, that should be fine. It's probably more secure than KDF1 & 2 that use a normal hash method and a 4 byte counter. HKDF however can certainly be used for this, but it seems you only need to differentiate, rather than extract and expand.
TL;DR: You put less of a burden an any attacker trying to brute-force this. And please note: Implementing PBKDF2 shouldn't be much harder than implementing your approach. Now let's head over to the explanation why "your" scheme is really bad for password-hashing. The scheme you propose is that each try cost you exactly two hash-function evaluations. One ...
Top 50 recent answers are included