Derived key: 32 bytes, repeatable with the same salt, different with a new salt
HashRandom and Mersenne32 repeat their sequence for the same seed
Password hash fields: 3 (iterations, salt, hash)
Encrypted<T> decrypts with the right secret and refuses the wrong one
