HKDF vs PBKDF2: which key derivation function fits which input, what NIST SP 800-108 Rev. 2 changes, and how to migrate.