--- a/jdk/src/java.base/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java	Fri Aug 19 13:38:12 2016 -0700
+++ b/jdk/src/java.base/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java	Fri Aug 19 22:15:32 2016 +0100
@@ -108,6 +108,11 @@
         }
         try {
             this.prf = Mac.getInstance(prfAlgo);
+            // SunPKCS11 requires a non-empty PBE password
+            if (passwdBytes.length == 0 &&
+                this.prf.getProvider().getName().startsWith("SunPKCS11")) {
+                this.prf = Mac.getInstance(prfAlgo, SunJCE.getInstance());
+            }
         } catch (NoSuchAlgorithmException nsae) {
             // not gonna happen; re-throw just in case
             InvalidKeySpecException ike = new InvalidKeySpecException();