# PBKDF2 uses HMAC-SHA1 to generate keys, but what is the key for the HMAC?

I was reading up on PBKDF2 and noted the following:

DK = PBKDF2(PRF, Password, Salt, c, dkLen)


PRF is a keyed HMAC, but I can't seem to find out what they use as key for the HMAC?

-
If unsure, read the specifications! –  owlstead Sep 4 '13 at 7:50

PBKDF2 uses the password as the PRF key.

From the RFC:

The first argument to the pseudorandom function PRF serves as HMAC's "key," and the second serves as HMAC's "text." In the case of PBKDF2, the "key" is thus the password and the "text" is the salt.

-