Use pbkdf2 package in appcommon/kdf. Use hmac.Equal to compare hmacs in appcommon/passwords