There are multiple ways to do this, but I recommend neither of the solution proposals in the question.
Instead you can, for instance, Use SHA-1 with PBKDF2, use KBKDF after PBKDF2, use authenticated en/decryption after PBKDF2, request longer output from PBKDF2.
Depending on your needs, any one of these could be the solution for you. For details, read on.
Using KBKDF after PBKDF2 is similar to your suggestion hash twice, but "better cryptographic hygiene", if doing key derivation, use should use a well-defined key derivation operation.
Similarly, requesting large than one block output from PBKDF2 is actually similar to your suggestion of performing PBKDF2 twice (as it ends up doing twice as much work) than deriving 160-bit value using PBKDF2 and HMAC-SHA2.
Short Introduction to PBKDF2
PBKDF2 is a function that is based on a PRF (pseudo random function).
Pseudo-Random functions accepted by PBKDF2 vary according to implementation.
RFC #2898 specified HMAC-MD5 and HMAC-SHA1. Many PBKDF2 implementations, use HMA-SHA1, and many of the test vectors available are using SHA1 (like RFC 6070).
However, PBKDF2 is not tied to HMAC-SHA1. Newer versions of specification (such as NIST SP 800-132) allow any HMAC based on any NIST approved hash (SHA-1 or SHA-2 family, such as SHA-256 or SHA-512).
Entropy
Using HMAC-SHA-1 with PBKDF2 puts 160-bit cap for the entropy of the password. If you want to retain entropy of high-entropy passwords (several tens of random characters), then this will become an issue. Thus, if you need 256-bit secret with full entropy, then you MUST not use SHA-1 and you must choose SHA-256.
Solutions
The solutions for using PBKDF2 to derive 256-bit secret are relatively straight forwards explained in NIST SP 800-132.
- Use HMAC-SHA-256 with PBKDF2 (may require different implementation of PBKDF2). Note: this will better retain entropy of high-entropy passwords as explained above.
- Use PBKDF2 to create up-to 160 bit secret that is used with key derivation (for instance NIST SP 800-108, KBKDF) or key wrapping (for instance NIST SP 800-38F, AES-KW) to derive or decrypt the 256-bit secret.
- Use PBKDF2 algorithm allows larger output than the size of hash. Thus you can use PBKDF2 (with HMAC-SHA1) to derive 256-bit value (uses twice as much time than above item #2) and does not provide more security against key brute-forcing attacks.
It is most important to acknowledge the each one of these choices will result in different keys. Thus, for interoperability concerns it may be that you are constrained in what option(s) you can choose.
PBKDF2.GetBytes(32)
directly. $\endgroup$ – CodesInChaos Jan 30 '14 at 13:06