What is the recommended way to derive a key for an HMAC-SHA256, from a passphrase and salt?
I'd like to compute an HMAC-SHA256. I have a passphrase, and a message.
I note that RFC-7518 (JWA) states that for HMAC,
A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm. (This requirement is based on Section 5.3.4 (Security Effect of the HMAC Key) of NIST SP 800-117, which states that the effective security strength is the minimum of the security strength of the key and two times the size of the internal hash value.)
From this I conclude that it is not recommended to use the bytes directly from the passphrase for the key. The passphrase may not have the appropriate entropy, if it is not 32 ascii characters in length. Even then, still ascii.
Question 1. correct?
ok, next up is to derive a key. I note that PBKDF2 can rely on HMAC-SHA256 to produce keys.
Question 2. But .... now I am in a turtles situation, am I not? I am using a HMAC-SHA256 with a low-entropy key, to derive a supposedly higher-entropy key for an HMAC-SHA256.
I had a heck of a time searching this forum, because every question uses the term hmac, password, pbkdf2, and sha-256. Basically I want to know if it is sensible to use PBKDF2 with HMAC-SHA256... to derive a key to be used in an HMAC-SHA256.