We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their [Special Publication SP 800-132][1] NIST basically recommends using PBKDF2 for password hashing." 

This may be a very important argument for our client (they adore standards). But I still cannot read this recommendation in plain text... So I can't claim it comfortably. In short NIST more or less say:

> The derived keying material is called a Master Key (MK), denoted as
> mk. The MK is used either 1) to generate one or more Data Protection
> Keys (DPKs) to protect data, or 2) to generate an intermediate key to
> protect one or more existing DPKs or generated from the MK using an
> approved Key Derivation Function (KDF) as defined in [2]. The MK shall
> not be used for other purposes.

Is there such a recommendation or this is just a myth?

  [1]: http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf