diff --git a/crypto/block-luks.c b/crypto/block-luks.c
index a5d9ebc..11047fa 100644
--- a/crypto/block-luks.c
+++ b/crypto/block-luks.c
@@ -1073,6 +1073,7 @@ qcrypto_block_luks_create(QCryptoBlock *block,
                                    masterkey, luks->header.key_bytes,
                                    luks->header.master_key_salt,
                                    QCRYPTO_BLOCK_LUKS_SALT_LEN,
+                                   QCRYPTO_BLOCK_LUKS_DIGEST_LEN,
                                    &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
@@ -1144,6 +1145,7 @@ qcrypto_block_luks_create(QCryptoBlock *block,
                                    (uint8_t *)password, strlen(password),
                                    luks->header.key_slots[0].salt,
                                    QCRYPTO_BLOCK_LUKS_SALT_LEN,
+                                   luks->header.key_bytes,
                                    &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
diff --git a/crypto/pbkdf.c b/crypto/pbkdf.c
index 35dccc2..0b902a8 100644
--- a/crypto/pbkdf.c
+++ b/crypto/pbkdf.c
@@ -65,13 +65,16 @@ static int qcrypto_pbkdf2_get_thread_cpu(unsigned long long *val_ms,
 int qcrypto_pbkdf2_count_iters(QCryptoHashAlgorithm hash,
                                const uint8_t *key, size_t nkey,
                                const uint8_t *salt, size_t nsalt,
+                               size_t nout,
                                Error **errp)
 {
     int ret = -1;
-    uint8_t out[32];
+    uint8_t *out;
     long long int iterations = (1 << 15);
     unsigned long long delta_ms, start_ms, end_ms;
 
+    out = g_new0(uint8_t, nout);
+
     while (1) {
         if (qcrypto_pbkdf2_get_thread_cpu(&start_ms, errp) < 0) {
             goto cleanup;
@@ -80,7 +83,7 @@ int qcrypto_pbkdf2_count_iters(QCryptoHashAlgorithm hash,
                            key, nkey,
                            salt, nsalt,
                            iterations,
-                           out, sizeof(out),
+                           out, nout,
                            errp) < 0) {
             goto cleanup;
         }
@@ -110,6 +113,7 @@ int qcrypto_pbkdf2_count_iters(QCryptoHashAlgorithm hash,
     ret = iterations;
 
  cleanup:
-    memset(out, 0, sizeof(out));
+    memset(out, 0, nout);
+    g_free(out);
     return ret;
 }
diff --git a/include/crypto/pbkdf.h b/include/crypto/pbkdf.h
index e9e4cec..6b7c54b 100644
--- a/include/crypto/pbkdf.h
+++ b/include/crypto/pbkdf.h
@@ -133,6 +133,7 @@ int qcrypto_pbkdf2(QCryptoHashAlgorithm hash,
  * @nkey: the length of @key in bytes
  * @salt: a random salt
  * @nsalt: length of @salt in bytes
+ * @nout: size of desired derived key
  * @errp: pointer to a NULL-initialized error object
  *
  * Time the PBKDF2 algorithm to determine how many
@@ -140,13 +141,16 @@ int qcrypto_pbkdf2(QCryptoHashAlgorithm hash,
  * key from a user password provided in @key in 1
  * second of compute time. The result of this can
  * be used as a the @iterations parameter of a later
- * call to qcrypto_pbkdf2().
+ * call to qcrypto_pbkdf2(). The value of @nout should
+ * match that value that will later be provided with
+ * a call to qcrypto_pbkdf2().
  *
  * Returns: number of iterations in 1 second, -1 on error
  */
 int qcrypto_pbkdf2_count_iters(QCryptoHashAlgorithm hash,
                                const uint8_t *key, size_t nkey,
                                const uint8_t *salt, size_t nsalt,
+                               size_t nout,
                                Error **errp);
 
 #endif /* QCRYPTO_PBKDF_H */
diff --git a/tests/test-crypto-pbkdf.c b/tests/test-crypto-pbkdf.c
index 8ceceb1..a651dc5 100644
--- a/tests/test-crypto-pbkdf.c
+++ b/tests/test-crypto-pbkdf.c
@@ -358,6 +358,7 @@ static void test_pbkdf_timing(void)
     iters = qcrypto_pbkdf2_count_iters(QCRYPTO_HASH_ALG_SHA256,
                                        key, sizeof(key),
                                        salt, sizeof(salt),
+                                       32,
                                        &error_abort);
 
     g_assert(iters >= (1 << 15));
