passphrases use pbkdf2 with 1K iterations