# Tag Info

11

Actually, it turned out that scrypt was not as good as initially advertised under all conditions. Scrypt was designed to support the specific case of password-based key derivation for full harddisk encryption. Basically, you type your password when the machine boots up (or awakes from hibernation). This is a context where the following apply: The password ...

5

I guess the honest answer is nobody can know for sure, however: There's a general rule of thumb in cryptography, that once there was been wide rewards for breaking an algorithm (be it a hash function, a cipher or in this case a key deviation function) but nobody has come to close the breaking it, then we are in the "safest period". Scrypt is almost ...

3

I should have started here: sub scrypt_hash { my ($key,$salt, $N,$r, $p) = _scrypt_extra(@_); return undef unless defined$key && defined $salt && defined$N && defined $r && defined$p; return "SCRYPT:$N:$r:$p:" . MIME::Base64::encode($salt, "") . ":" . MIME::Base64::encode($key, ""); } It explains that the last ... 3 Yes, this is secure, even though scrypt uses PBKDF2 inside. PBKDF2 has the issue that it the work factor is required$n$times where$n$is the number hash outputs concatenated to create the final PBKDF2 output. That means that if you can check the validity of PBKDF2 using only the initial bits (in your case used for the key if the hash was SHA-256, for ... 2 I know PBKDF2 is essentially "useless" against anyone with a GPU rig and I have read that bcrypt is "useless" to anyone with an FPGA setup. Neither is useless. Newer alternatives like scrypt and the eventual PHC winner make better use of the defenders' resources, but even a thousand iterations of PBKDF2 is useful, compared to doing nothing. If you assume ... 2 r determines the sequential read size. This should only be changed if you have custom hardware that has a memory subsystem with different characteristics. It takes time to pull data from main memory, and the sequential read size allows the memory latency and CPU processing to be well-balanced on your system. Treat it like a constant unless you know what you'... 1 Which parameters are suitable for your system depends on what execution time you accept. Higher values increase the security - but also the execution time. The default parameters for scrypt are N=16384, r=8, p=1 (16 MB memory). But this recommendation is now 6 years old and custom hardware has evolved. If the execution time is not an issue, it would be ... 1 SCrypt is a Password Based Key Derivation Function or PBKDF. In general you don't need such a function if your input is already a key. In that case you need a Key Based Key Derivation Function - a KBKDF. Currently the best KBKDF is probably HKDF. This can take a key (e.g. the public key), info (e.g.$i$or the hash over$i\$) and possibly a salt. As it is ...

Only top voted, non community-wiki answers of a minimum length are eligible