pbkdf2_sha1.nx

pbkdf2_sha1.nx -- PBKDF2 key derivation with HMAC-SHA1. RFC 2898 / PKCS#5 v2.0. The SHA-1-based variant was once the web standard for password hashing and is still used by: - WPA2 PSK -> PMK derivation (802.11i-2004 requires PBKDF2-SHA1 with 4096 iterations) - Older OS X Keychain + iOS data protection - 1Password .agilekeychain / .keychain vault decryption - Legacy JWT \"PBES2\" JOSE key derivation For new password hashing use Argon2id (memory-hard) or at least PBKDF2-SHA-256 with iter_count >= 600000 (OWASP 2023). Algorithm (§5.2): DK = T_1 || T_2 || ... || T_l T_i = F(password, salt, c, i) F(P, S, c, i) = U_1 XOR U_2 XOR ... XOR U_c U_1 = HMAC-SHA1(P, S || INT(i)) INT(i) is u32 big-endian U_j = HMAC-SHA1(P, U_{j-1}) for j = 2..c Composes hmac_sha1.nx. Invariants: PB1 Output length `dk_len` in bytes; at most 2^32 - 1 blocks (not checked; callers requesting > 10MB keys are daft). PB2 iterations must be >= 1; we treat 0 as \"no stretching\" which RFC doesn't define. PB3 Salt + password byte-exact; no UTF-8 normalisation.