Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once? I am going to store secrets from users. The secrets need to be stored confidentially. For this question, I am concerned only with confidentiality (not integrity).

Here is how my encryption scheme is:


We start with a 20-character randomly generated alphanumeric password.
A new 128-bit salt is generated randomly for each user secret to be stored.
The 20-character password and the 128-bit salt is passed through a HMAC-SHA256-based PBKDF2 function to derive a new 256-bit encryption key for each user secret to be saved.
A new 128-bit initialization vector is generated for each user secret to be saved.
The 256-bit encryption key and the 128-bit initialization vector is used to perform AES-256-CBC encryption of the secret and arrive at the ciphertext.
The salt, initialization vector, and the resulting ciphertext are all saved together.


I want to know if in steps 2 and 3, is it necessary to run the password through PBKDF2 every time for every new secret to be protected?

Or can we just run the password through PBKDF2 only once and use that key for all secrets to be protected?

Is there any provable benefit of generating a different key (with PBKDF2) for each user secret even if we start with the same alphanumeric password every time?
Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to encrypt. Is $E_p(m_1+m_2+\cdots+m_n)$ or $E_p(m_1)+E_p(m_2)+\cdots+E_p(m_n)$ better for this? Each invocation of $E$ is slow due to it running a KDF on $p$, but an attacker only needs to guess $p$ once. This means that both techniques are equally secure against an attacker assuming $E$ takes a constant amount of time, but the former is significantly faster for honest parties, so the former is better.

The purpose of a slow KDF is to make brute force of a weak, human-generated password difficult. You need to run it each time a password is input. Assuming only one password is being input, then it only has to be run through a KDF once. The output key can be used to protect as many secrets as you wish.

The reason is simple. If an attacker manages to guess the original password, they'll be able to use it again and again to decrypt all the data, whether or not the data was encrypted all at once or encrypted piece by piece by running the password through a KDF multiple times to generate multiple keys.