From the Skein 1.3 paper section 4.8, Skein as a Password-Based Key Derivation Function (PBKDF), it mentions the following as a simple PBKDF (S = seed and P = password):
An even simpler PBKDF is to simply create a very long repetition of S and P; e.g., S||P||S||P||S..., and hash that using Skein. (Any other optional data can also be included in the repetition.) This approach is not ideal with a normal hash function, as the computation could fall into a loop. But in Skein, every block has a different tweak and is thus processed differently.
The advantages I can see is that it is very simple to implement and hard to break the implementation accidentally.
Is this a more effective PBKDF than PBKDF2?
What about being more effective than Scrypt?
Is this a memory hard approach as well as CPU intensive? I imagine for a large length string e.g. 256 bit length seed + 256 bit length password (32 ASCII chars), repeated 100,000 times, this would force an attacker to use 6MB~ of memory to test one password. I imagine this could be easily customized to use the amount of memory required to be significantly slow for calculation and also require x MBs of memory per calculation.
What is a strong security level using this method? E.g. how many repetitions of the Seed and Password would be required? 100,000? 1000,000?