I’ve posted a new errata on the iosptl site about PBKDF2 and SHA-1 versus SHA-2. If you’re using CommonCryptor (and particularly CommonKeyDerivation), you may be interested.