maybe we should have a password derivation method with pbkdf2 in [RFC2898](http://datatracker.ietf.org/doc/rfc2898/?include_text=1)