Use a standard KDF for deriving keys.

This commit replaces the use of sha256 to derive keys with a standard kdf,
PBKDF2 from PKCS#5.

The defaults are:

Hash algorithm for psuedo random numbers: HMAC-SHA1
Iteration Depth: 2000
Key length: 16 bytes for AES
Salt: Empty