No need for pbkdf2, just slows things down.

Secret AES key is plenty random w/o it.