If I know the derived key DK1
DK1 = PBKDF2(sha512, password, random_salt, iterations = 1000, output length = 20)
it is possible to calculate the derived key DK2
DK2 = PBKDF2(sha512, password || SOME_TEXT, random_salt, iterations = 1000, output length = 20)
if I have full admin access (both to the hashing algorithm in the source code and to the salts in the DB) but I don't know the password? I know this would be possible if I would only use SHA1 to hash the password but what about pbkdf2? Why do I ask: I want to use DK1 for user authentication and DK2 in the DB for data anonymization (only the logged in user can perform joins between tables signed with user.id and tables signed with DK2). For that reason I have to make sure that no one can derive DK2 from DK1 otherwise the DB tables would not be properly anonymized and the DB admin could perform joins.