Is it safe to use a key as message in keyed hashing (HMAC)? Scenario:


User gives password.
A "password key" is derived from the password (e.g. by PBKDF2). A random salt is applied.
The password key is hashed with a HMAC algorithm (e.g. HMAC-SHA256), with itself as the key.
The salt and HMAC result are stored in database, for verification of the password (for further user logins).
The password key is used to encrypt other data.


Question: Is it safe to apply step 3 in terms of: can the password key be (easily) determined because it is known that it is the message to be HMACed?
Question: Is it safe to apply step 3 in terms of: can the password key be (easily) determined because it is known that it is the message to be hashed?


Yes, this should be fine, although you might as well use a constant as the message input when calculating the HMAC. Theoretically some implementation could be more lax with regard to side channel attacks about the message than the key, though I doubt that is an issue in practice.

Knowing the self-HMAC of the key will allow an attacker to easily verify their guessed passwords, but PBKDF2 will slow them down and anyway the speedup is not significant, compared to attempting to decrypt the data with the derived key.

(There are better alternatives to PBKDF2, like scrypt, argon2, bcrypt.)