Is SHA-256 OK to use for key derivation for a key that is never persisted?

Question

The scenario: On the one side a user enters a pass phrase to encrypt a stream of data (AES-GCM) and a symmetric encryption key is derived from the pass phrase using plain SHA-256 (so not a slow function). Data is sent using TLS. On the other side another user has to enter the same pass phrase to derive the same key for decryption. If the key is never persisted, does it matter that a fast key derivation function is used?

Answer 1

In Key derivation functions, you enter a secret that is your password, salt, and the number of iterations.

$$key = \operatorname{KDF}(\text{passowrd}, \text{salt}, \text{iterations})$$

The salt is a countermeasure against the rainbow table attacks. The salt also increases the entropy of the produced key. Since the attackers cannot use a rainbow table, they have to use execute password search, the most popular is hashcat where it can utilize GPU's cores. This where the number if iterations become important. If a fast key derivation is used then the password search will be very fast. Think about the usual 10000 iterations vs 1.

In your case, you even didn't mention the salt. Without the salt, a SHA-256 rainbow table can easily find the password if it exists in the table.

As mentioned in the comments, by F.Grieu; The modern Key derivation functions has more parameters. For example; Argon2 has also memorySizeKB and parallelism parameters as a countermeasure against GPU and ASIC based passwords search attacks. Without these parameters, the GPUs and ASICs can search the passwords massively in parallel process.

• An 8x Nvidia GTX 1080 can calcaulte 2865.2 MH/s SHA-256 hashes.

You should use the Scrypt or Argon2, the winner of Password Hashing Competition.