I have a program that generates a fixed-length 32 byte (256-bit) password using RNGCryptoService provider and then uses Rfc2898DeriveBytes on that password to arrive at an encryption key.

However, to save system resources, I was thinking about just using the original password. Am I right that there is no benefit to using Rfc2898DeriveBytes on the 256-bit password generated by RNGCryptoServiceProvider? 256-bits is the key size for the algorithm (AES-256) so I should be able to use the password unchanged. Is RNG cryptographically secure enough to generate the keys directly?

2 Answers 2


"PBKDF2" begins by "PB" which means "Password-Based". This is for passwords. A password is not just a sequence of letters; it is a sequence of letters that a human can remember and type. A 256-bit key, generated as keys should be (with a cryptographically strong PRNG), is not a password, even if you encode it as letters.

Another way to say it is that the core of the functionality of PBKDF2 is to cope with the inherent weakness of passwords: since they can be managed by human brains, they are weak and can be brute forced. A proper cryptographic key (like the one you generate with RNGCryptoServiceProvider) does not have this weakness, and thus has no need for PBKDF2.

Now there is a tangential use: PBKDF2 is not only PB, it also is a KDF. It has a configurable output length. As such, if your source key is shorter than what you need, then a KDF, in particular PBKDF2, can be handy to obtain as much key material as you wish. For instance, you have a 256-bit key, but you need to encrypt and to have checked integrity, and for that you would like to have a 256-bit AES key and a 256-bit key for HMAC. To turn a 256-bit master key into 512 bits of key material, you need a KDF. However, PBKDF2, with its password-specific idiosyncrasies (input is letters, not bits; there is a need for a salt), is ill-suited in general for such jobs. SSL/TLS uses for such jobs a custom function (which has been quite thoroughly investigated, since SSL is a high-profile target for cryptographers) which it calls "the PRF".


Yes, you are right. You will have no problems using a randomly generated 256-bit password generated using a CSPRNG as the encryption key.

RNGCryptoServiceProvider calls the Windows CSPRNG CryptGenRandom directly so you can be sure that your key is generated with a secure RNG.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .