Is using SHA256 to extract entropy from a p-rand nonce a good way to create keying material?

Using $SHA256(N)$, where $N$ is 64 bytes of output from the Microsoft Windows CryptGenRandom function. Are there any known vulnerabilities with using this method to create key material? Should $N$ be more than the SHA256 block size of 64 bytes? Aligning to block size means 2 passes through the (internal) hashing function, (block and finalize), is this enough?

• I would personally do 119 bytes, that fills the 2nd block to capacity – Richie Frame Sep 4 '14 at 19:40
• @Richie Frame, I think you might be right. The reason I align to the block is of course a resource factor. Having stepped through SHA256 code many times, I just can't see why it would matter.. but still, it may be a potential vulnerability. It's a trade off I'm not sure I want to make. – JGU Sep 4 '14 at 19:48
• Personally, I'd use HMAC-SHA256. See this paper for why and some other possible constructions to consider (especially if your processor has AES-NI). – mikeazo Sep 4 '14 at 19:51
• @mikeazo -That occurred to me as well, I can't remember why I didn't use HMAC, I'll take a look at it again.. thanks – JGU Sep 4 '14 at 19:53

CryptGenRandom is supposed to produce cryptographically strong random numbers, so you shouldn't need to process it before using as a key.