I think (from issue tracker spelunking) PBKDF2 got added in because at some point the PSKs weren't very strong and intended to be human-transmittable. They're s

I think (from issue tracker spelunking) PBKDF2 got added in because at some point the PSKs weren't very strong and intended to be human-transmittable. They're still in the transport protocol. I'm not sure why, but I guess for some parameter choices it could improve forward secrecy? (That is: if you break a KEX at t=0 now you have to compute a hard function a bunch of times to make it to t=now if sessions are long-held? Seems far-fetched but...) It's really nice to see protocols where people use memo fields to make sure one key can't be derived for another purpose though, and that is a feature you get out of PBKDF2 (but not only PBKDF2, hence my question) :)