Deriving a key for HMAC, using PBKDF2

Question

What is the recommended way to derive a key for an HMAC-SHA256, from a passphrase and salt?

I'd like to compute an HMAC-SHA256. I have a passphrase, and a message.

I note that RFC-7518 (JWA) states that for HMAC,

A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm. (This requirement is based on Section 5.3.4 (Security Effect of the HMAC Key) of NIST SP 800-117, which states that the effective security strength is the minimum of the security strength of the key and two times the size of the internal hash value.)

From this I conclude that it is not recommended to use the bytes directly from the passphrase for the key. The passphrase may not have the appropriate entropy, if it is not 32 ascii characters in length. Even then, still ascii.

Question 1. correct?

ok, next up is to derive a key. I note that PBKDF2 can rely on HMAC-SHA256 to produce keys.

Question 2. But .... now I am in a turtles situation, am I not? I am using a HMAC-SHA256 with a low-entropy key, to derive a supposedly higher-entropy key for an HMAC-SHA256.

I had a heck of a time searching this forum, because every question uses the term hmac, password, pbkdf2, and sha-256. Basically I want to know if it is sensible to use PBKDF2 with HMAC-SHA256... to derive a key to be used in an HMAC-SHA256.

Answer 1

No, you should not use a password directly as an HMAC key.

However, it is fine to use HMAC as part of a key derivation function, which generates keys from a password. However, do not mistake the output as naturally having higher entropy than whatever you put in. "password" has essentially 0-bits of entropy, and running it through a KDF will not magically give it 256 more.

Using PKDF2 with HMAC-SHA256 as its PRF to generate a key from a password which will then be used as an HMAC key for other purposes is completely fine. The iteration must be high enough, which at this point in time is around a quarter of a million, which takes about 0.1s on a moderately fast computer.