Bouncy Castle and Salsa 20 I want to use Salsa 20 in Java, so I downloaded Bouncy Castle, and... it makes no sense to me. I've got it working, but most of my choices were essentially random. But I can't see there anything leading me to the right path. The interface CipherParameters accepts nearly any nonsense and a key size of 257 bits works perfectly.

private static StreamCipher newCipher(byte[] password, byte[] salt) {
    int iterations = 50000; // really?
    PBEParametersGenerator generator =
        new PKCS5S2ParametersGenerator(); // really this one?
    generator.init(password, salt, iterations);
    Arrays.fill(password, (byte) 0);
    final CipherParameters cipherParameters =
        generator.generateDerivedParameters(256, 64); // would 257 be better? :D
    final StreamCipher result = new Salsa20Engine();
    result.init(true, cipherParameters);
}


As I wrote, it works, but is this the right way? Especially,


Is PKCS5S2 with 50000 iterations a good choice?
The password gets stored nowhere, so I'm assuming, the only thread would be an attacker having access to both the plaintext and the ciphertext, xoring them together, and using it for verification of their password guesses. Am I right?
Concerning the practical POV, is there a way how to verify I did nothing seriously wrong (like switching password and salt or using a inappropriate method)?
My code above is a fascinating huge damping pile of... you know.

generator.init(password, salt, iterations);
Arrays.fill(password, (byte) 0);


BC fails to copy the content of the password array, so my security "improvement" of clearing the password after use, clears it before use and leads to a password of all zeros.

Btw., the mailing list was no better than this site. No answer.