Yes - this is reasonable. I'd generalise this to: "Use an accepted key derivation function, such as PBKDF2, bcrypt or scrypt, with accepted parameters". What

Yes - this is reasonable. I'd generalise this to: "Use an accepted key derivation function, such as PBKDF2, bcrypt or scrypt, with accepted parameters". What is "accepted" changes over time, of course.