I have a program that generates a fixed-length 32 byte (256-bit) password using RNGCryptoService provider and then uses Rfc2898DeriveBytes on that password to arrive at an encryption key.

However, to save system resources, I was thinking about just using the original password. Am I right that there is no benefit to using Rfc2898DeriveBytes on the 256-bit password generated by RNGCryptoServiceProvider? 256-bits is the key size for the algorithm (AES-256) so I should be able to use the password unchanged. Is RNG cryptographically secure enough to generate the keys directly?


"PBKDF2" begins by "PB" which means "Password-Based". This is for passwords. A password is not just a sequence of letters; it is a sequence of letters that a human can remember and type. A 256-bit key, generated as keys should be (with a cryptographically strong PRNG), is not a password, even if you encode it as letters.

Another way to say it is that the core of the functionality of PBKDF2 is to cope with the inherent weakness of passwords: since they can be managed by human brains, they are weak and can be brute forced. A proper cryptographic key (like the one you generate with RNGCryptoServiceProvider) does not have this weakness, and thus has no need for PBKDF2.

Now there is a tangential use: PBKDF2 is not only PB, it also is a KDF. It has a configurable output length. As such, if your source key is shorter than what you need, then a KDF, in particular PBKDF2, can be handy to obtain as much key material as you wish. For instance, you have a 256-bit key, but you need to encrypt and to have checked integrity, and for that you would like to have a 256-bit AES key and a 256-bit key for HMAC. To turn a 256-bit master key into 512 bits of key material, you need a KDF. However, PBKDF2, with its password-specific idiosyncrasies (input is letters, not bits; there is a need for a salt), is ill-suited in general for such jobs. SSL/TLS uses for such jobs a custom function (which has been quite thoroughly investigated, since SSL is a high-profile target for cryptographers) which it calls "the PRF".


Yes, you are right. You will have no problems using a randomly generated 256-bit password generated using a CSPRNG as the encryption key.

RNGCryptoServiceProvider calls the Windows CSPRNG CryptGenRandom directly so you can be sure that your key is generated with a secure RNG.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.