Salt generation in C# I have designed a small method to generate a salt for a password. All this does is create a random salt and does nothing to add it to the password. I have a few questions regarding my very simple method:


Is this a secure generator?
Currently, it encodes in base64. Is this an issue in any way?
Are there any other potential issues? How could I improve this in terms of security, speed, etc...




using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using System.Text;
using System.Security.Cryptography;

namespace Test
{
    public class Program
    {
        // Here is a method to generate a random password salt
        private static string getSalt()
        {
            var random = new RNGCryptoServiceProvider();

            // Maximum length of salt
            int max_length = 32;

            // Empty salt array
            byte[] salt = new byte[max_length];

            // Build the random bytes
            random.GetNonZeroBytes(salt);

            // Return the string encoded salt
            return Convert.ToBase64String(salt);
        }

        static void Main(string[] args)
        {
            System.Console.WriteLine(getSalt());
            System.Console.ReadKey();
        }
    }
}
var
You should use them with max_length and salt too. If the type is obvious from the right hand side of the assignment you should use var.
From here

Under what circumstances is it necessary for a variable's type to be clearly understood when reading the code? Only when the mechanism of the code -- the &quot;how it works&quot; -- is more important to the reader than the semantics -- the &quot;what its for&quot;.

So basically in a line like
byte[] salt = new byte[max_length];  

or
int max_length = 32;  

the type of the variables does not add any value to the code. It is too obvious what the assigned type is, using the type instead of var only adds noise to the code without any real value.
Disposing
If an object implements IDisposable you should either call its Dispose() method or enclose it in an using block.
Naming
Also variables local to a method aren't mentioned in the naming guidelines I would suggest to use camelCase casing for naming them instead of snake_case casing.
For naming private methods you should use PascalCase casing.
Comments
Comments should only describe why something is done. Let the code itself explain what is done by using meaningful and readable names.
A very good answer about comments can be found here: https://codereview.stackexchange.com/a/90113/29371
getSalt()
You should allow to pass the max_length to the method instead of hardcoding it. This has the advantage that a change to this value won't need the class class/method to be changed. If you make it an optional parameter you can still call it like it whould have no parameter.
Edit
Based on the valid comment from Johnbot you should better use a overloaded GetSalt() method instead of using an optional parameter.
I don't see the need for converting to base64. Encryption algorithms use byte[] arrays, so you should better just return the byte[].

Applying the above would lead to
private static int saltLengthLimit = 32;
private static byte[] GetSalt()
{
    return GetSalt(saltLengthLimit);
}
private static byte[] GetSalt(int maximumSaltLength)
{
    var salt = new byte[maximumSaltLength];
    using (var random = new RNGCryptoServiceProvider())
    {
        random.GetNonZeroBytes(salt);
    }

    return salt;
}