Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a program that generates a fixed-length 32 byte (256-bit) password using RNGCryptoService provider and then uses Rfc2898DeriveBytes on that password to arrive at an encryption key.

However, to save system resources, I was thinking about just using the original password. Am I right that there is no benefit to using Rfc2898DeriveBytes on the 256-bit password generated by RNGCryptoServiceProvider? 256-bits is the key size for the algorithm (AES-256) so I should be able to use the password unchanged. Is RNG cryptographically secure enough to generate the keys directly?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

"PBKDF2" begins by "PB" which means "Password-Based". This is for passwords. A password is not just a sequence of letters; it is a sequence of letters that a human can remember and type. A 256-bit key, generated as keys should be (with a cryptographically strong PRNG), is not a password, even if you encode it as letters.

Another way to say it is that the core of the functionality of PBKDF2 is to cope with the inherent weakness of passwords: since they can be managed by human brains, they are weak and can be brute forced. A proper cryptographic key (like the one you generate with RNGCryptoServiceProvider) does not have this weakness, and thus has no need for PBKDF2.

Now there is a tangential use: PBKDF2 is not only PB, it also is a KDF. It has a configurable output length. As such, if your source key is shorter than what you need, then a KDF, in particular PBKDF2, can be handy to obtain as much key material as you wish. For instance, you have a 256-bit key, but you need to encrypt and to have checked integrity, and for that you would like to have a 256-bit AES key and a 256-bit key for HMAC. To turn a 256-bit master key into 512 bits of key material, you need a KDF. However, PBKDF2, with its password-specific idiosyncrasies (input is letters, not bits; there is a need for a salt), is ill-suited in general for such jobs. SSL/TLS uses for such jobs a custom function (which has been quite thoroughly investigated, since SSL is a high-profile target for cryptographers) which it calls "the PRF".

share|improve this answer

Yes, you are right. You will have no problems using a randomly generated 256-bit password generated using a CSPRNG as the encryption key.

RNGCryptoServiceProvider calls the Windows CSPRNG CryptGenRandom directly so you can be sure that your key is generated with a secure RNG.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.