*    Keys must be unique to the device and may use input from the user to compute the key. 
*    When generating a key from password, use salt. 
*    When generating a key from password, specify an appropriate hash iteration count. 
*    Use a key of length sufficient to guarantee this strength of encryption.
