PBKDF2-HMAC-SHA-256 password hashing backed by pbkdf2_elixir.

pbkdf2_elixir is a required Digestif dependency and owns salt generation, key derivation, the modular (passlib-style) encoded format, and verification. Digestif owns adapter dispatch, configuration policy, transparent migration, and the minimal resource preflight described below.

Hashes are always minted explicitly as HMAC-SHA-256 with a 16-byte salt and a 32-byte derived key — the backend's HMAC-SHA-512/160,000-round defaults are never inherited. :iterations (default 600,000) is the round count for new hashes and dummy work, translated once to the backend's :rounds option; the validator rejects fewer than 600,000, the OWASP minimum for PBKDF2-HMAC-SHA-256. Do not tune below the floor for tests; use a deliberately cheap custom test hasher instead. pbkdf2_elixir derives in pure Elixir rather than through OTP's native :crypto PBKDF2, so benchmark login latency on production hardware before raising :iterations.

Stored hashes are held to a verification budget: :max_iterations defaults to the configured :iterations and may not fall below it (every hash this configuration mints must stay verifiable), so a hostile, imported, or corrupted value can never make one verification more expensive than a login the host already pays for. Hosts that must keep verifying stronger imported hashes raise the budget explicitly:

{Digestif.PBKDF2,
 iterations: 600_000, max_iterations: 1_000_000}

Trust boundary

Stored hashes are application-controlled database values, not untrusted network input. This adapter is a minimal resource preflight, defence in depth for corrupted, imported, or unexpectedly modified values: it bounds the total encoded length before any other work, extracts only the algorithm identifier and round count for the budget decision, and hands everything else to pbkdf2_elixir, which owns complete format parsing and cryptographic validation. Values the preflight rejects fail closed after the configured dummy work, and malformed values below its ceilings are the backend's to reject — the backend signals rejection by raising, which this adapter normalizes to the same fail-closed dummy path.

Hashes minted by Bonafide's pre-extraction, pre-backend adapter used URL-safe Base64 for the salt and digest segments and are not accepted by the backend's passlib-style decoder.