Derive cipher IV and cipher Key using PBKDF2 with random salt?

Question

It is said that cipher IV does not have to be secret and the only secret component of the encryption scheme should be a cipher key.

Question: is it safe to generate IV using PBKDF2 function, which takes password and randomly generated salt as input (Scheme 2)? Or do I have to use only completely random IV which has no relationship to password whatsoever (Scheme 1)? In other words, is Scheme 2 less secure, equally secure or more secure than Scheme 1?

NOTE: To generate entropy based on password/salt I use a hybrid PBKDF2/HKDF approach described here, where PBKDF2 generates PRK which has the same length as used hash function (SHA-2) and then expands PRK to obtain sufficient entropy to populate KEY (Scheme 1) or IV + KEY (Scheme 2).

Example of Encryption Scheme 1 - traditional approach:

1. Input data: Password and Message (e.g. plaintext to encrypt).
2. Generate completely random SALT (using system entropy provider).
3. Generate completely random IV (using system entropy provider).
4. Use Password and SALT as input for PBKDF2/HKDF function, which generates and expands entropy based on input data.
5. Use obtained entropy to set cipher KEY, use IV that was generated in step 3.
6. Encrypt Message, send SALT + IV + cipher text to the receiver.

Example of Encryption Scheme 2 - generating IV with PBKDF2:

1. Input data: Password and Message (e.g. plaintext to encrypt)
2. Generate completely random SALT (using system entropy provider).
3. Use Password and SALT as input for PBKDF2/HKDF function, which generates and expands entropy based on input data.
4. Use obtained entropy to set cipher IV and KEY.
5. Encrypt Message, send SALT + cipher text to the receiver.

For decrypting, we use received SALT (and possibly, IV - if Scheme 2 is used), setup cipher according to the used scheme and decrypt message.

So, is Scheme 2 less secure, equally secure or more secure than Scheme 1? In my opinion, it should not be less secure, since for every message SALT, IV and KEY are going to be completely different. Besides, IV is unpredictable, since to generate it, we use SALT - which is unpredictable, since it is considered to be completely random. It is probably more secure, since in Scheme 1, SALT and IV are known to an attacker, and in Scheme 2 an attacker knows only SALT. Even if it is said that IV does not have to be secret, is it not better to try to reveal to an attacker as little information as possible?

Can Scheme 2 help an attacker to determine password more easily than in Scheme 1?

Answer 1

It is secure. The IV only needs to be indistinguishable from random to an attacker, and it is as long as the salt is random.

---

There is one remark: if you extract more key + iv bytes than the hash function in PBKDF2 returns then the PBKDF2 function is executed twice. An attacker however only has to find the key, not the IV, so an attacker doesn't have to do this, halving the security provided by the number of iterations.

You could use a KBKDF (Key Based Key Derivation Function) rather than direct extraction to get the key and IV. So you would have:

S = PBKDF2(salt, password, iterations)
K = KBKDF(S, 'enc')
IV = KBKDF(S, 'iv')

A good KBKDF is HKDF-expand.