What approaches are generally accepted for generating a password-protected symmetric key?
My intuition is to generate and store a random string of appropriate length as the password-protected key, then HMAC it with a PBKDF2ed password to get the actual symmetric key. With this approach, is the PBKDF2 step necessary or superfluous? Is there a better approach (e.g., XORing the generated key bits with the PBKDF2ed password key bits)?
Edit: I realized after making this post that it makes more sense to do
HMAC(key, password) than
Update: The answer is
PBKDF2(SHA256, password, key, iterations).