fix: use recommended 16-byte salt in gen_salt

src/argus.gleam

@@ -162,7 +162,7 @@ pub fn verify(encoded_hash: String, password: String) -> Result(Bool, HashError)
   jargon_verify(encoded_hash, password)
 }
 
-/// Generate a random salt of at least 64 bytes.
+/// Generate a random 16-byte salt.
 @external(erlang, "argus_nif", "gen_salt")
 pub fn gen_salt() -> String
 

src/argus_nif.erl

@@ -11,15 +11,5 @@ hash(Password, Salt, Algorithm, TimeCost, MemoryCost, Parallelism, HashLength) -
       {error, Error}
   end.
 
-gen_random_int(Min, Max) ->
-  crypto:strong_rand_bytes(4),
-  <<Int:32/integer>> = crypto:strong_rand_bytes(4),
-  Int rem (Max - Min) + Min.
-
-%% Use a min of 64 bytes rather than the default of 32
-%% for additional security.
 gen_salt() ->
-  Bytes = gen_random_int(64, 1024),
-  base64:encode(crypto:strong_rand_bytes(Bytes)).
-
-
+  base64:encode(crypto:strong_rand_bytes(16)).

test/argus_test.gleam

@@ -1,4 +1,5 @@
 import argus
+import gleam/bit_array
 import gleam/set
 import startest.{describe, it}
 import startest/expect
@@ -167,6 +168,11 @@ pub fn gen_salt_tests() {
       |> set.size
       |> expect.to_equal(num_salts)
     }),
+    it("should generate a 16-byte salt", fn() {
+      let salt = argus.gen_salt()
+      let assert Ok(bytes) = bit_array.base64_decode(salt)
+      assert bit_array.byte_size(bytes) == 16
+    }),
     it("should generate salts usable by the Argon2 algorithms", fn() {
       let salt = argus.gen_salt()
       let assert Ok(hashes) =