I have two parties that want to communicate with each other based on a shared password. The protocol is using PBKDF2 (with HMAC-SHA256) to create a shared key on both sides (due to restrictions on the channel, ECDH is not possible). In order to run PBKDF2, they need to exchange a short message, the salt. The salt should be authenticated to prevent against MITM-Attacks.
This should be done by showing a 6-digit alphanumeric value on the display of each party (based on the Numeric Comparison approach of Bluetooth or the Compare-and-Confirm approach). The alphanumeric value consists of all letters of the alphabet, except I,O,Q and U, and all numbers from 0 to 9. Thus, there are in total 32 characters and a 1-digit alphanumeric value can describe 5 bits. The 6-digit value can describe 30 bits. Each party has to compare and confirm the correct value.
The question is how to compute the 6-digit alphanumeric value based on the salt that is 32 bytes long. Is the best way to use SHA-256 and truncate the output to 30 bits? Or might it be a better idea to use a slow cryptographic hash algorithm (maybe PBKDF2 again but values can actually be precomputed so there shouldn't be any advantage) in order to increase the computational time for a MITM-Adversary? This could also be enforced by setting a time limit for the authentication.