The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively:
$U_1 = PRF(password, salt)$
$U_2 = PRF(password, U_1)$
$U_n = PRF(password, U_n-1)$
The standard then defines the actual key material
$K = F(password, salt, n)$
where F is $U_1 \oplus U_2 \oplus \cdots U_n$
I don't understand what the purpose of XORing the blocks together is. Assuming that PRF is a cryptographically strong function, how does XORing the blocks help? Why is $U_n$ not strong enough key material by itself?
The standard mentions that the blocks are XORd together “to reduce concerns about the recursion degenerating into a small set of values” but I guess I don't understand how that can happen since the password is being fed back into the function at each iteration.
If the recursion can degenerate into a small set of values, doesn't that mean there is a short cycle in the hash function? Isn't that a “bad thing” for cryptographic hash functions?
(1) Assume for simplicity that the key is the same length as the hash function output.