ncb000gt/node.bcrypt.js — pull request #225 by jfirebaugh (2014-04-09 14:45:59+00:00)
Title: Remove the seed_length argument

[`bcrypt_gensalt` expects a seed of exactly BCRYPT_MAXSALT (16) bytes](https://github.com/ncb000gt/node.bcrypt.js/blob/906860691011c9b088a11561f848690265bbda8b/src/bcrypt.cc#L158); other values are not useful:

* seed_length < 16 results in an invalid read
* seed_length > 16 (e.g. the default of 20) generates extra random bytes and then discards them

In general, I don't see a clear use case for user-specified seed length. Neither the [ruby](https://github.com/codahale/bcrypt-ruby/blob/f167f92c702ea6b01a9995e3089f49b95c34eecb/lib/bcrypt/engine.rb#L72) nor [python](https://code.google.com/p/py-bcrypt/source/browse/bcrypt/__init__.py#54) implementations allow this.

For backward compatibility, I have not removed support for a three-argument call to `genSalt`; the former `seed_length` parameter is simply ignored. If you want to remove the ignored argument and increment to version 0.8.0 I'm fine with that too.

I'm also curious why the library uses `RAND_bytes`/`RAND_pseudo_bytes`, thus requiring a direct OpenSSL dependency and the attendant locking incantations, rather than using `crypto.randomBytes`. If you are amenable, I will submit a pull request to change that and remove the OpenSSL dependency.