Replace SHA-256 with PBKDF2 for key derivation, fixing #1