I guess the only argument for algorithm or iterations being public is that you can create a PBKDF2HMAC object and then ask it what type of HMAC it's going to do. That's probably not important since this API is really designed for the object to be immediately used.