import sodium, mem

proc kdf*(pass: SecBuf, salt: array[16, byte]): SecBuf =
  result = mkbuf(crypto_aead_xchacha20poly1305_ietf_KEYBYTES)
  let rc = crypto_pwhash(result.p, result.len.csize_t, pass.p, pass.len.culonglong,
                         addr salt[0], crypto_pwhash_OPSLIMIT_MODERATE,
                         crypto_pwhash_MEMLIMIT_MODERATE.csize_t,
                         crypto_pwhash_ALG_ARGON2ID13)
  if rc != 0:
    free(result)
    quit("key derivation failed", 1)