use pbkdf2_sha512 by default