pub fn pbkdf2_sha256(password: &[u8], salt: &[u8], iters: u32) -> [u8; 32]Expand description
PBKDF2-HMAC-SHA256 with dkLen fixed at 32 — exactly SCRAM’s Hi()
(RFC 5802 / RFC 7677): one output block, so U1 = HMAC(password, salt ‖ 0x00000001)
and the derived key is the running XOR of the U chain over iters iterations.
HMAC over a FIXED key precomputes the inner/outer block midstates once, so each iteration costs two compressions instead of four — the pure LOGOS reference does the naive four; the result is byte-identical.