So you essentially then end up with PBKDF2, as long as you're using an HMAC configuration with your hashing function you should be ok. That said, just go ahead

So you essentially then end up with PBKDF2, as long as you're using an HMAC configuration with your hashing function you should be ok. That said, just go ahead and use a PBKDF2 library so that you match what others do and you have an easier time with interoperability if you have to use a different language or environment somewhere else with the same set of users. The reason you want to use HMAC is the same as always, it provides better security against a number of attacks that could recover the secret, https://en.wikipedia.org/wiki/Hash-based_message_authentication_code#Security https://en.wikipedia.org/wiki/Hash-based_message_authenticat...