# Multiple iterations of AES for key derivation?

The keepass password manager uses multiple rounds of AES for its key derivation, as described here. I was somewhat surprised that it wasn't using pbkdf2, bcrypt, or something more common. Essentially, the key derivation is:

key = sha256(password)
cipher = AES(random_seed1, ECB)
for i in number_of_iterations:
key = cipher.encrypt(key)
key = sha256(key)
key = sha256(random_seed2 + key)


Is there a name for this kdf? Are there other systems that use something similar? I'm mostly interested in general background info on the above approach. Are there any weaknesses in this approach? It seems considerably simpler than pbkdf2 and bcrypt.

• I don't recognize it from anywhere. But a negative answer is tricky; I don't think I know all the KDF's ever invented. I'm not so sure if it is simpler than other approaches. It seems to use two primitives - AES-256 and SHA-256 instead of one. I'm pretty sure it is safe. It seems that they used two primitives that are readily available on most platforms. Because they are not using the state as a key, it may be that an attacker has a larger advantage than with other schemes though. – Maarten Bodewes Aug 28 '13 at 7:33
• Why not something like $\operatorname{KDF}(k,s,n) = \bigoplus_{i=1}^n \operatorname{AES}_{\operatorname{MD5}(k \mathbin\| s)}(i)$ instead? – forest Jan 14 '19 at 3:18