diff --git a/0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch b/0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
new file mode 100644
index 0000000..181fedd
--- /dev/null
+++ b/0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
@@ -0,0 +1,86 @@
+From 754862899058cfb5f2341c81f9e04dd2f7b37056 Mon Sep 17 00:00:00 2001
+From: Clemens Lang <cllang@redhat.com>
+Date: Thu, 17 Nov 2022 18:37:17 +0100
+Subject: [PATCH] pbkdf2: Set minimum password length of 8 bytes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The Implementation Guidance for FIPS 140-3 says in section D.N
+"Password-Based Key Derivation for Storage Applications" that "the
+vendor shall document in the module’s Security Policy the length of
+a password/passphrase used in key derivation and establish an upper
+bound for the probability of having this parameter guessed at random.
+This probability shall take into account not only the length of the
+password/passphrase, but also the difficulty of guessing it. The
+decision on the minimum length of a password used for key derivation is
+the vendor’s, but the vendor shall at a minimum informally justify the
+decision."
+
+We are choosing a minimum password length of 8 bytes, because NIST's
+ACVP testing uses passwords as short as 8 bytes, and requiring longer
+passwords combined with an implicit indicator (i.e., returning an error)
+would cause the module to fail ACVP testing.
+
+Signed-off-by: Clemens Lang <cllang@redhat.com>
+---
+ providers/implementations/kdfs/pbkdf2.c | 27 ++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/providers/implementations/kdfs/pbkdf2.c b/providers/implementations/kdfs/pbkdf2.c
+index 2a0ae63acc..aa0adce5e6 100644
+--- a/providers/implementations/kdfs/pbkdf2.c
++++ b/providers/implementations/kdfs/pbkdf2.c
+@@ -35,6 +35,21 @@
+ #define KDF_PBKDF2_MAX_KEY_LEN_DIGEST_RATIO 0xFFFFFFFF
+ #define KDF_PBKDF2_MIN_ITERATIONS 1000
+ #define KDF_PBKDF2_MIN_SALT_LEN   (128 / 8)
++/* The Implementation Guidance for FIPS 140-3 says in section D.N
++ * "Password-Based Key Derivation for Storage Applications" that "the vendor
++ * shall document in the module’s Security Policy the length of
++ * a password/passphrase used in key derivation and establish an upper bound
++ * for the probability of having this parameter guessed at random. This
++ * probability shall take into account not only the length of the
++ * password/passphrase, but also the difficulty of guessing it. The decision on
++ * the minimum length of a password used for key derivation is the vendor’s,
++ * but the vendor shall at a minimum informally justify the decision."
++ *
++ * We are choosing a minimum password length of 8 bytes, because NIST's ACVP
++ * testing uses passwords as short as 8 bytes, and requiring longer passwords
++ * combined with an implicit indicator (i.e., returning an error) would cause
++ * the module to fail ACVP testing. */
++#define KDF_PBKDF2_MIN_PASSWORD_LEN (8)
+ 
+ static OSSL_FUNC_kdf_newctx_fn kdf_pbkdf2_new;
+ static OSSL_FUNC_kdf_freectx_fn kdf_pbkdf2_free;
+@@ -186,9 +201,15 @@ static int kdf_pbkdf2_set_ctx_params(void *vctx, const OSSL_PARAM params[])
+         ctx->lower_bound_checks = pkcs5 == 0;
+     }
+ 
+-    if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PASSWORD)) != NULL)
++    if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PASSWORD)) != NULL) {
++        if (ctx->lower_bound_checks != 0
++            && p->data_size < KDF_PBKDF2_MIN_PASSWORD_LEN) {
++            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
++            return 0;
++        }
+         if (!pbkdf2_set_membuf(&ctx->pass, &ctx->pass_len, p))
+             return 0;
++    }
+ 
+     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SALT)) != NULL) {
+         if (ctx->lower_bound_checks != 0
+@@ -297,6 +318,10 @@ static int pbkdf2_derive(const char *pass, size_t passlen,
+     }
+ 
+     if (lower_bound_checks) {
++        if (passlen < KDF_PBKDF2_MIN_PASSWORD_LEN) {
++            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
++            return 0;
++        }
+         if ((keylen * 8) < KDF_PBKDF2_MIN_KEY_LEN_BITS) {
+             ERR_raise(ERR_LIB_PROV, PROV_R_KEY_SIZE_TOO_SMALL);
+             return 0;
+-- 
+2.38.1
+
diff --git a/openssl.spec b/openssl.spec
index 043d28f..2ed1533 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -172,6 +172,8 @@ Patch81: 0081-signature-Remove-X9.31-padding-from-FIPS-prov.patch
 Patch82: 0082-kbkdf-Add-explicit-FIPS-indicator-for-key-length.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2136250
 Patch83: 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2137557
+Patch84: 0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=2142121
 Patch85: 0085-FIPS-RSA-disable-shake.patch
 #https://github.com/openssl/openssl/pull/17546
@@ -523,6 +525,8 @@ install -m644 %{SOURCE9} \
   Resolves: rhbz#2144019
 - Add explicit indicator for HMAC with short key lengths
   Resolves: rhbz#2144000
+- Set minimum password length for PBKDF2 in FIPS mode
+  Resolves: rhbz#2144003
 
 * Tue Nov 01 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-43
 - CVE-2022-3602: X.509 Email Address Buffer Overflow