# Is concatenated data hashed with scrypt vulunarable to a length extension attack?

scrypt takes a salt, and a password plus some cost paramters to generate a key. So say we define it as this:

key = scrypt(password, salt, cost)


I am interested in using it for generating passwords deterministically. E.g. to create a password for amazon or apple I would so something like:

amazonpassword = base64(scrypt("username" + "masterpassword", "amazon", cost))


So I wonder if this is suspectable to a length extenson attack. E.g. if an attack found out what:

scrypt("masterpassword", "amazon", cost)


is, could they then use that as a basis for guessing what:

scrypt("username" + "masterpassword", "amazon", cost)


is? If so what is the best approach for avoiding this problem? Should I use a HMAC to generate the masterpassword string?

-
I think scrypt inherits the zero padding length extension from PBKDF2. scrypt(s, salt) == scrypt(s + \0, salt) for short enough s shorter than 64 bytes. –  CodesInChaos May 16 '14 at 16:51