Using bcrypt derived keys for encryption? Sorry for this ignorant question but I am currently weighing up the advantages and disadvantages of BCrypt over PBKDF2 and from what I have read BCrypt is considered more secure but from what I have discovered BCrypt only derives as 248-bit key (Example: E2cP18g8DyWwg3emgpHOaPBZzrcRVrO) and the rest of it is the salt, however I require a 512-bit key so I can split it into two sub-keys on for a AES encryption key and the other for HMAC generation.

Would it be secure to take the sha-512 hash of the key produced by BCrypt and split that or should I just keep using PBKDF2?
BCrypt is considered more secure


The theoretical security of bcrypt has received less scrutiny than that of PBKDF2, SHA2 and HMAC.  PBKDF2 is thus widely standardised (e.g. in NIST SP800-132 and PKCS #5) while bcrypt is not.

In practice the security (resistance to brute force attack or dictionary attack) of bcrypt and PBKDF2-HMAC-SHA512 can be controlled by a workload parameter.  bcrypt is more secure than PBKDF2 in the sense that: if you select the workload parameters such that the algorithms use the same computing time on a general-purpose CPU, then an attacker able to choose their hardware (CPU, GPU, FPGA, or ASIC) can attack PBKDF2 4 to 6 times more effectively than bcrypt at the same cost (see the scrypt paper).

As a heuristic we could say that a password hashed with PBKDF2 should have 2 to 3 bits more randomness than a password hashed with bcrypt to achieve equivalent security (against a brute force attack; for equivalent workload parameters).


  Would it be secure to take the sha-512 hash of the key produced by BCrypt and split that


No, but you're on the right path by splitting the operation into a step that produces a key, and a step that expands the key.  The trick is to select the right primitives for these operations.

To expand a key - that is, to produce using one key a stream of derived random output suitable for use as key material - you need a Pseudorandom Function Family (PRF).  SHA-512 is not a PRF, but HMAC-SHA512 is.  Using HMAC-SHA512 would be a secure - but not ideal - solution.

A better solution is to use HKDF which splits key derivation into extraction and expansion steps.  By using bcrypt or PBKDF2 you have already extracted a pseudorandom key (HKDF calls this a PRK) from the password.  You can apply the HKDF expansion step to that PRK to produce derived keying material of any length; equivalently you could use one of the Key Derivation Functions from NIST SP800-108.

See also Do any security experts recommend bcrypt for password storage? for more on PBKDF2 vs bcrypt.