We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their [Special Publication SP 800-132][1] NIST basically recommends using PBKDF2 for password hashing." This may be a very important argument for our client (they adore standards). But I still cannot read this recommendation in plain text... So I can't claim it comfortably. In short NIST more or less say: > The derived keying material is called a Master Key (MK), denoted as > mk. The MK is used either 1) to generate one or more Data Protection > Keys (DPKs) to protect data, or 2) to generate an intermediate key to > protect one or more existing DPKs or generated from the MK using an > approved Key Derivation Function (KDF) as defined in [2]. The MK shall > not be used for other purposes. Is there such a recommendation or this is just a myth? [1]: http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf