Sanitise password after hashing.

Add a couple of tests to check that malformed hashes are handled properly

SecureRandom.getInstanceStrong() uses /dev/random on Linux which may block if out of entropy ...

new SecureRandom() uses /dev/urandom

Switch to Bouncy Castle Base64 to avoid leaks

Reimplement toBytes to avoid Charset.encode method which may leak hashes

Reimplement the parsing to avoid the regex group method which creates strings that we can't sanitise.

Switch to cleaner log2 implementation

Switch to more modern and stronger RNG

Fix potential timing attack due to manually comparing hashes with a loop ...

The number of loop iterations can be used as an indication of how close a guessed hash is to the correct one.

Update Bouncy Castle

Overwrite byte arrays in check method

Update README.md

Updated deps, upped work factor, add timing tests

Update bouncy castle dependency

log2 now complains if it is given a number that is not a power of 2.

Minor edit.

More markdown fixes.

Fixed header problem in README.

Added example and README.

Switched to CharSequence/CharBuffer.

Initial commit.