Scrypt's maximum strength to increase entropy of lame passwords

The developers claim that a 6 letter long password hashed with 3.8 second's of scrypt would cost $900 to brute-force. • If we use more cycles, how quickly will the brute force cost increase? • What are the minimum system requirements to compute such a huge KDF on a desktop or mobile? • Is there any formula to estimate its entropy based on CPU cycle time? • Does Scrypt survive from Grover's algorithm? Please consider that bad passwords can be very long. - "Is there any formula to estimate its entropy based on CPU cycle time?" The run time of scrypt does not indicate the amount of entropy in password. Instead, if necessary, the entropy of password/passphrase needs to be estimated with some other means (such as if password is based on dictionary, checking what is the character set the password is based on (letters/letters and numbers/also special characters) and so on). – user4982 Dec 17 '13 at 19:43 2 Answers You have to test it on the hardware you'll be using. I tried CryptSharp's implementation with a cost of 262144 and it took about 7 seconds. The reason it costs more is cause of the memory it uses, and my process that was running the Scrypt was eating up 340ish MB. How much of that was from the KDF? Don't know. How would my box handle 100 people authenticating at the same time? Very good question. This is something you need to performance tune to specific hardware. - The developers claim that a 6 letter long password hashed with 3.8 seconds of scrypt would cost$900 to brute-force.

Very important: This is the cost of finding the password within a year by building an ASIC in 2002.

Not so important: There seems to be only one person behind scrypt: Colin Percival.

If we use more cycles, how quickly will the brute force cost increase?

The most expensive part (this is the whole point of scrypt) of an ASIC would be the memory. Doubling the cycles means that you use twice as much memory for twice as much time, i.e., doubling the cycles makes a brute-force attack roughly 4 times as expensive.

What are the minimum system requirements to compute such a huge KDF on a desktop or mobile?

The parameters used in the example taking 3.8 seconds are $(N,r)=(2^{20},8)$. Theorem 2 of the scrypt paper says you need $128Nr$ bytes of memory, so the computer has to have at least 1 GiB of RAM.

Length is irrelevant. The cost of brute-forcing a password is determined by $(N,r)$ and the password's entropy.