--- a/CHANGES.txt	Wed Aug 01 22:54:10 2018 +0100
+++ b/CHANGES.txt	Thu Aug 02 07:19:23 2018 +0100
@@ -16,6 +16,10 @@
 Features:
 
 - issue2550901: add search page to jinja2 template (Christof Meerwald)
+- issue2550982: use PBKDF2 in Python's hashlib, if available (Python
+  2.7.8+), to improve performance over bundled pure Python
+  version. Note that acceleration via m2crypto is no longer supported
+  (Christof Meerwald)
 
 Fixed:
 

--- a/roundup/password.py	Wed Aug 01 22:54:10 2018 +0100
+++ b/roundup/password.py	Thu Aug 02 07:19:23 2018 +0100
@@ -73,9 +73,11 @@
         return b64decode(data + b"=", b"./")
 
 try:
-    from M2Crypto.EVP import pbkdf2 as _pbkdf2
+    from hashlib import pbkdf2_hmac
+    def _pbkdf2(password, salt, rounds, keylen):
+        return pbkdf2_hmac('sha1', password, salt, rounds, keylen)
 except ImportError:
-    #no m2crypto - make our own pbkdf2 function
+    #no hashlib.pbkdf2_hmac - make our own pbkdf2 function
     from struct import pack
     from hmac import HMAC
 
@@ -119,7 +121,7 @@
     :param rounds: number of rounds to use to generate key
     :arg keylen: number of bytes to generate
 
-    If M2Crypto is present, uses it's implementation as backend.
+    If hashlib supports pbkdf2, uses it's implementation as backend.
 
     :returns:
         raw bytes of generated key