Encrypt a small amount of data with a password derived from PBKDF2

Question

I have a small amount of data (about 128 bits) to secured with a strong password.

I plan to run PBKDF2-SHA2-256 on the password and a 128 bit random salt to generate a 256 bit derived key. Then with the first 128 bits of the derived key (Key1), XOR it with the data to encrypt it. Then create a MAC by using the last 128 bits of the derived key (Key2) i.e. HMAC-SHA-256(Key2, encrypted data). The data would be stored as salt | encrypted data | MAC tag.

Is it fine to do that? Or is there a more standard construct?

Answer 1

Is it fine to do that?

Yes, it should be fine, as long as you do not reuse the key/salt-pair for encrypting another piece of data.

Or is there a more standard construct?

Any authenticated encryption algorithm would work. E.g. AES-GCM with the PBKDF2-derived key.

If you are going to use the same password for encrypting many such pieces of data there are more efficient ways to do it, so that you do not need to compute PBKDF2 anew for each of them. For example, have a constant salt for it and also a message-dependent nonce you use for the encryption algorithm.

There are also alternatives for PBKDF2 that you might prefer, like bcrypt, scrypt, argon2, if you happen to have them available. They make it more difficult to test password guesses, which you might want if you are unsure about the strength of the password.