public final class Pbkdf2

PBKDF2 (RFC 8018) with HMAC-SHA-256 or HMAC-SHA-512: the password hash of key stores and vaults, and with SHA-512 and 2048 iterations the seed of a BIP-39 mnemonic.

A CryptoEngine that derives natively is used when one is installed (every client port installs one). Otherwise the derivation runs in Java, and still costs two hash compressions per iteration: the HMAC key’s inner and outer padded blocks are compressed once, up front, and each iteration resumes from those two states with the previous output as its only block. A straightforward HMAC loop re-hashes both padded keys every round, twice the work.

byte[] mnemonicUtf8 = Mnemonic.generate(128).getBytes("UTF-8");
byte[] saltUtf8 = "mnemonic".getBytes("UTF-8");    // "mnemonic" + passphrase
byte[] seed = Pbkdf2.hmacSha512(mnemonicUtf8, saltUtf8, 2048, 64);