I am not creating my own cryptography or anything, but to learn about the Dos and Donts of cryptography, I am looking into AES encryption and ways to generate keys for that.
As far as I've understood, one of the options to create cryptographically secure keys would be to gather entropy from /dev/urandom/ and then feed that data through the Salsa20 cipher.
But I am unsure about the next step, because that’s where search engines stop being useful to me. From what I understand, using the output Salsa20 generates doesn’t seem to be secure enough to be used as key material as-is. Am I correct? If, what would be the cryptographically correct next step after I've retrieved the Salsa20 output?
Also, if there are any references or papers I should be aware about, it would be great if you could mention them too.