To convert a password to an AES key, PBKDF2 is the simplest way of handling it. Just make the sure the password has sufficient entropy.
You do need to use a salt, because it's there to protect against rainbow table attacks.
Depending on your platform, there may already be libraries available to help with this. If not, I'd recommend something close to Lucus Kaufman's solution.
- Generate a random 128-bit key (k1), a random 128-bit IV, and a random salt (64 bits is probably sufficient).
- Use PBKDF2 to generate a 256-bit key from your password and the salt, then split that into two 128-bit keys (k2, k3).
- Make sure your algorithm's native output is at least 256 bits, or this will be slow. PBKDF2-SHA256 is a good choice. Don't use two seperate algorithms for this, since it will just make it slower and more complicated for you, but won't slow an attacker down.
- If your password already has sufficiently high entropy, then you can afford to use a fairly low number of iterations. 1000 iterations will be so fast you won't even notice it (especially since you'll only need to decrypt the key when the program starts up), so there's not much reason to go below that. If your password is weaker, you can turn up the number of iterations to compensate.
- I don't recommend using bcrypt for this, since it's output is the wrong size and you would need to hash it again, which adds unnecessary complexity.
- I think scrypt can generate arbitrary-sized output, so it would be a good choice if it's available (this may not be allowed if you want FIPS compliance).
- Use k2 to AES encrypt k1 using the random IV.
- Save the encrypted key, k3, the salt and the IV to a file somewhere.
Encryption / Decryption:
- Use PBKDF2 + your password and the salt from the file to regenerate k2 and k3.
- Verify k3. If it doesn't match, either your password is wrong, or someone tampered with your file. Stop here.
- Use k2 and the IV from the file to decrypt k1.
- Use k1 to encrypt or decrypt files.
- Decrypt k1 as in the Encryption / Decryption section.
- Follow the steps in Setup, using the same k1, but regenerate everything else (new random salt and IV, generate k2 and k3 from the new password).
Do not store k2 anywhere. Do not store k1 unencrypted. Doing either of those things will break the security of your system.
If you don't care about being able to change your password (I would consider this a very important feature, but maybe you don't), then you could skip the steps involving k1, and use k2 as your AES key and k3 to verify it.
You may also find it useful to generate another key for HMAC, so you can verify that the encrypted files haven't been tampered with. If you want to do that, you can generate a 128-bit HMAC key, and encrypt and store that with the main AES key.