Index: config.template.php
===================================================================
--- config.template.php	(revision c1b15785eb10d765b61cf05c55a781c4de4b8a6b)
+++ config.template.php	(revision c2f407588ed516b8cf12343da4b654d7b4892370)
Index: create.php
===================================================================
--- create.php	(revision c1b15785eb10d765b61cf05c55a781c4de4b8a6b)
+++ create.php	(revision c2f407588ed516b8cf12343da4b654d7b4892370)
@@ -24,28 +24,52 @@
 <?php }
 else {
-	$salt = mcrypt_create_iv ( 16, MCRYPT_RAND );
+	// We're creating something
+
+	// Random padding
+	//$salt = mcrypt_create_iv ( 16, MCRYPT_RAND );
+	$salt = \Sodium\randombytes_buf(\Sodium\CRYPTO_PWHASH_SALTBYTES);
+
+	// Value sent to end user to collect password
 	$hash = md5 ( mcrypt_create_iv ( 128, MCRYPT_RAND ) );
+
+	// ID sent to end user
 	$id = substr ( md5 ( mcrypt_create_iv ( 128, MCRYPT_RAND ) ), 4, 6 );
 	
-	//CheckID is valid against db
-	
+	//TODO: Check ID is valid against db
+
+	// Metadata
 	$reference = $_POST[ 'reference' ];
+	$username = $_SERVER[ 'REMOTE_USER' ];
+	$username = "test";
+
+	// What we're actually storing
 	$password = $_POST[ 'passwd' ];
-	$username = $_SERVER[ 'REMOTE_USER' ];
-	
+
+	// AES initialisation vector	
 	$iv = mcrypt_create_iv ( 32, MCRYPT_RAND );
 	
-	//This needs to be a more secure hash - maybe run 100000 cycles? or move to sCrypt?
-	$key = pack ( 'H*', hash ( 'sha256', $salt . $reference . $hash ) );
-	
+	// AES KDF - This needs to be a more secure hash - maybe run 100000 cycles? or move to sCrypt?
+	// $key = pack ( 'H*', hash ( 'sha256', $salt . $reference . $hash ) );
+	$key = \Sodium\crypto_pwhash(
+			32, //AES256 - 256/8 = 32
+			$reference . $hash,
+			$salt,
+			\Sodium\CRYPTO_PWHASH_OPSLIMIT_MODERATE,
+			\Sodium\CRYPTO_PWHASH_MEMLIMIT_MODERATE
+		);
+
+	// Get the Ciphertext
 	$enc = encrypt ( $password, $key, $iv );
 	
-	//This needs to be a more secure hash - maybe run 100000 cycles? or move to sCrypt?
+	// This needs to be a more secure hash - maybe run 100000 cycles? or move to sCrypt?
 	$check = pack ( 'H*', hash ( 'sha256', $enc . $hash ) );
 	
-	
-	create_password ( $id, $reference, date( "Y-m-d H:i:s" ), $username, $salt, $iv, $check, $enc ); ?>
-	
-	<p>Congratulations - hash created - <?php echo ( $hash ); ?> - id - <?php echo ( $id ); ?>. </p>
+	// Add to database
+	create_password ( $id, $reference, date( "Y-m-d H:i:s" ), $username, $salt, $iv, $check, $enc );
+
+	// Output some stuff
+	?>
+
+		<p>Congratulations - hash created - <?php echo ( $hash ); ?> - id - <?php echo ( $id ); ?>. Key: <?php print_r ( unpack( 'H*', $key ) ); ?>, Salt: <?php print_r ( unpack( 'H*', $salt ) ); ?></p>
 	
 <?php }
Index: include.php
===================================================================
--- include.php	(revision c1b15785eb10d765b61cf05c55a781c4de4b8a6b)
+++ include.php	(revision c2f407588ed516b8cf12343da4b654d7b4892370)
Index: index.php
===================================================================
--- index.php	(revision c1b15785eb10d765b61cf05c55a781c4de4b8a6b)
+++ index.php	(revision c2f407588ed516b8cf12343da4b654d7b4892370)
@@ -48,8 +48,16 @@
 		die ( 'Incorrect hash' );
 	}
-	
+	print_r ( unpack ( "H*", $salt ) );	
 	delete_password ( $pass_id, $REASON_SUCCESS );
 	
-	$key = pack( 'H*', hash( 'sha256', $salt . $reference . $hash ) );
+	// $key = pack( 'H*', hash( 'sha256', $salt . $reference . $hash ) );
+	$key = \Sodium\crypto_pwhash(
+			32, //AES256 - 256/8 = 32
+			$reference . $hash,
+			$salt,
+			\Sodium\CRYPTO_PWHASH_OPSLIMIT_MODERATE,
+			\Sodium\CRYPTO_PWHASH_MEMLIMIT_MODERATE
+		);
+
 	$dec = decrypt ( $password, $key, $iv ); ?>