"Only use the users password to obtain a long random key" (emphasis mine).

So it was part of the initial recipe.