3 ms·

I think he means that your AES-CBC should already be doing key derivation from the user supplied password.