same recommendation: pass `password` and `salt` as Buffers, convert them locally according to whatever SJCL needs, then return a Buffer. Or pass in hex and pass out hex. But I'd avoid using plain old unicode strings in the API.

I'd also mark the docstring with a note explaining that the params/returns are strings that contain hex, so readers don't get confused and think you mean a string that contains 0x00-0xff codepoints.