use pbkdf2 to derive password