# Use a SHA256 as a key for AES256

Is it safe to use the SHA256 of a hard-to-bruteforce string as the key to encrypt data with AES256?

We assume that the attacker knows the key generation method, too. Therefore, firstly, the attacker will try to brute-force for possible strings and simple combinations. Users should choose a good entropy source for this kind of method.

If the user has hard-to-bruteforce string to enter any Cryptographically secure hash function, i.e. it has pre-image, secondary pre-image, and collision resistance, then the user can be safe.. For passwords, collision resistance is not important, pre-image, secondary pre-image resistance are important.

The definition of hard-to-bruteforce string is vague since it is not clear under which conditions, when, and against who. Therefore, while assuming that you have a hard-to-bruteforce string as a password we need to turn the usual advice.

For key generation from passwords, you should prefer, passwords based key generation algorithms. Bcrypt and PBKDF2 are well-known examples. There is also Argon2 which has the winner of the Password Hashing Competition in July 2015. One of the aim of Password-Based Key Derivation functions is reducing the timing of the Brute-force password searching - like hashcat. This is achieved by iterating the hashing many times, like 10K, using large memory to reduce parallelization as done in GPU's.

Keep in mind that, in general, humans cannot remember hard-to-bruteforce string. It is advised to use a password manager to keep passwords. Now, it turns into the chicken-egg problem. How to remember the hard-to-bruteforce string for the password manager.

The Password-Based Key Derivation Functions are the solution for general users. With some restrictions on the passwords ( forcing some level of password space, 10-char, 1 upper, 1 decimal, 1 punctuation, etc...) the attack time can be adjusted according to current known attack levels. So, in practice, the minimal security is set.

• Hupersons meaning? – forest Aug 20 '19 at 7:33
• @forest just a joke. Hu-man -> to Hu-person. I'll update the answer... – kelalaka Aug 20 '19 at 7:35
• It answers my question. What i mean behind 'hard-to-bruteforce string' is that we don't bother about the complexity of the string for my question. I just wanted to know if it was a safe way to use SHA256 to generate a key for AES256 regardless the string used for the hash. – xaoc2nd Aug 20 '19 at 13:13

Yes, it is safe. The answer of @kelalaka (the first part, before update) it not correct.

The OP is saying that the password is a strong string which is hard to bruteforce. That's why the answer of @kelalaka the attacker, firstly, will try to brute-force is not relevant to the question. Everything @kelalaka is saying about password stretching is correct, but it is not relevant to this particular question.

I am curious why would you want to user SHA256 instead of password, if your password is complex and is hard to bruteforce. But this is another story.

I would suppose that some readers who didn't read the question attentively will vote my answer down. Some people don't think much and just apply patterns that they have in their minds, like Password? --> hashing is bad --> use stretching instead But guys, read the question once again.

• I didn't know you could use a password, I thought you had to use a string of 256 bit to use AES 256 – xaoc2nd Aug 20 '19 at 7:38
• I've updated my answer, according to this, you may need to update. – kelalaka Aug 20 '19 at 9:47

As kelalaka suggested, a single SHA256 hash of the password is not sufficiently secure, although it works. PBKDF2 uses many chained iterations of a hash like SHA256 to derive an AES key from a password. bcrypt, scrypt, and argon2 are newer key derivation functions that increase the difficulty of deriving the key by implementing an iterative hash that also requires a lot of memory (which GPUs typically do not have).

• Unfortunately you didn't read the question properly. The OP says that the password is a strong string which is hard to bruteforce. SHA256 will not do it weaker. – mentallurg Aug 19 '19 at 22:58
• You're right - if you assume that "hard to bruteforce" means "not in some rainbow table somewhere, and not something you are likely to randomly generate in the first x billion strings you throw into your huge stack of GPUs", a single SHA256 hash would be safe. – Bob Wall Aug 20 '19 at 23:16