I am using PBKDF2 on NodeJS to authenticate a user who submits username & password. To do this, when the user first registers, I generate a salt, I use 200000 iterations, I specify a key length of 32 bytes, and I use sha256 as the digest method. With the output of that operation, I store a serialized JSON object containing the derived key, hex-encoded salt, quantity of iterations and the digest method. This works for authenticating subsequent login attempts.
However I am now interested in using the user's same password to encrypt certain data, in addition to authenticating the username and password.
I'm not sure how to do this, since storing the derived key from PBKDF2 obviously exposes that key.
What is a secure way of doing this? Do I have to just run PBKDF2 a second time and use a different salt? Seems like I'm needlessly doubling the amount of time by doing that.
Is there a better way?