Expand description
PBKDF2 (RFC 8018) over the SHA-2 hash family: password-based key derivation, as the Web Cryptography API serves it.
Like hkdf-sha2, this interface mints no keys. It mints
derive-inputs — parameterized derivations — which the key-minting
interfaces’ derive-key functions consume, and which yield raw output
through derivation.derive-input.derive-bits. The password resource
and its import stay pbkdf2’s, so one imported password can
parameterize derivations of either hash family.
There is deliberately no prepare-from here: adopting another
derivation’s output as a password inverts the primitive’s purpose.
hkdf-sha2.prepare-from is the chaining path.
Functions§
- prepare
- Parameterize a derivation:
saltand the iteration count are bound now, and the output length arrives per use (the platform’s own split —Pbkdf2ParamsatderiveBits, length from the target’s get-key-length atderiveKey).