I know, that PBKDF2 uses HMAC with SHA2 function as PRF. But.. can I use many iterations of HMAC with SHA2 directly? Is this effective and securely? P.S I need the best function, but I can’t use bcrypt, argon, pbkdf2.

  • 5
    $\begingroup$ PBKDF2 is many iterations of HMAC, arranged in a certain way. If you can use many iterations of HMAC, and can decide how, then you can build PBKDF2. Not that it can give "the best function", which requires memory and a memory-hard construction. $\endgroup$
    – fgrieu
    Commented Feb 26, 2023 at 14:19
  • 2
    $\begingroup$ PBKDF2 (or nearly equivalently iterations of HMAC) pursue different objectives than "ECC with nistp256 curve". Asking which one to uses without context is like asking; tricycle or glider? Addition: PBKDF2 is a purposely slow key derivation function, sometime used for entropy stretching (but poor at that). "ECC with nistp256 curve" is for things like signature, or public-key encryption, or key exchange. $\endgroup$
    – fgrieu
    Commented Feb 26, 2023 at 16:21
  • 3
    $\begingroup$ @Murrchalkina: "what will be effective for my requirements" - What requirements you mean? You have not defined any single requirement. $\endgroup$
    – mentallurg
    Commented Feb 26, 2023 at 16:52
  • 2
    $\begingroup$ @Murrchalkina I use C# as well and PBKDF2 is here, just specify HMAC-SHA-2 instead of using the default HMAC-SHA-1. I mentioned Balloon because it can be implemented using a hash function, although I wouldn't recommend trying until you're more experienced. $\endgroup$ Commented Feb 26, 2023 at 18:18
  • 1
    $\begingroup$ Well, you could use PBKDF1 as implemented by PasswordDeriveBytes instead (also a horrid name), sanity, consistency, principle of least surprise and security be damned. It also relies on HMAC :P Anyway for both PBKDF1 (just joking, do not use) and PBKDF2, do not ask for more bits/bytes than the output size of the hash function used! $\endgroup$
    – Maarten Bodewes
    Commented Feb 27, 2023 at 2:47

1 Answer 1


If you can't use an existing secure key derivation function but do have access to a SHA2 primitive, you can implement pbkdf2 yourself. It's not as good as using an existing trusted implementation and definetly inferior to modern memory hard functions but still better than a general lets iterate one way or another.

PBKDF2 is fairly simple to implemet but still has some key details, like using a salt and mixing in the input repeatedly.

  • 1
    $\begingroup$ The thing is he does appear to have access to PBKDF2, so there's no need to implement anything. He's using the C# System.Security.Cryptography namespace, which offers PBKDF2. $\endgroup$ Commented Feb 27, 2023 at 18:08
  • 1
    $\begingroup$ I missed that, I only read the question which stated can't use PBKDF2, I took it at face value. I explictly stated using a well understood trusted implementation is superior. $\endgroup$
    – Meir Maor
    Commented Feb 28, 2023 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.