PBKDF2, bcrypt and scrypt actually have their own advantages and disadvantages. I think for embedded devices PBKDF2 is preferable and more performant, and given

PBKDF2, bcrypt and scrypt actually have their own advantages and disadvantages. I think for embedded devices PBKDF2 is preferable and more performant, and given different threat model, you may choose one over the other. A classic read is https://blog.mozilla.org/warner/2014/05/23/the-new-sync-protocol/ https://blog.mozilla.org/warner/2014/05/23/the-new-sync-prot... (unfortunately the presentation is 404) but the blog post is enough for a read.