Function prepare 

pub async fn prepare(
    variant: Sha2Variant,
    input: &Password,
    salt: Vec<u8>,
    iterations: u32,
) -> Result<DeriveInput, Error>

Parameterize a derivation: salt and the iteration count are bound now, and the output length arrives per use (the platform’s own split — Pbkdf2Params at deriveBits, length from the target’s get-key-length at deriveKey).

Security:

• iterations is the work factor: it is the only brake on brute-force attack against the password. Use the largest count your latency budget allows.
• Use a unique random salt per password, so equal passwords do not derive equal keys and precomputed tables do not apply.

A zero iteration count fails error.other, the platform’s OperationError (RFC 8018 requires a positive count), checked here rather than at use so a misparameterized input cannot mint. An implementation not serving the variant fails error.unsupported (the truncated SHA-2 variants are unserved package-wide).

Unlike hkdf-sha2.prepare, running the derivation early cannot discard the base secret entirely: PBKDF2 has no extract step, so the input retains password-derived keyed state (the PRF’s key schedule) for its lifetime — equivalent in sensitivity to HKDF’s retained PRK, and still not the raw password bytes.