# Scrypt's maximum strength to increase entropy of lame passwords

The developers claim that a 6 letter long password hashed with 3.8 second's of scrypt would cost $900 to brute-force. • If we use more cycles, how quickly will the brute force cost increase? • What are the minimum system requirements to compute such a huge KDF on a desktop or mobile? • Is there any formula to estimate its entropy based on CPU cycle time? • Does Scrypt survive from Grover's algorithm? Please consider that bad passwords can be very long. • "Is there any formula to estimate its entropy based on CPU cycle time?" The run time of scrypt does not indicate the amount of entropy in password. Instead, if necessary, the entropy of password/passphrase needs to be estimated with some other means (such as if password is based on dictionary, checking what is the character set the password is based on (letters/letters and numbers/also special characters) and so on). Dec 17, 2013 at 19:43 ## 2 Answers You have to test it on the hardware you'll be using. I tried CryptSharp's implementation with a cost of 262144 and it took about 7 seconds. The reason it costs more is cause of the memory it uses, and my process that was running the Scrypt was eating up 340ish MB. How much of that was from the KDF? Don't know. How would my box handle 100 people authenticating at the same time? Very good question. This is something you need to performance tune to specific hardware. The developers claim that a 6 letter long password hashed with 3.8 seconds of scrypt would cost$900 to brute-force.

Very important: This is the cost of finding the password within a year by building an ASIC in 2002.

Not so important: There seems to be only one person behind scrypt: Colin Percival.

If we use more cycles, how quickly will the brute force cost increase?

The most expensive part (this is the whole point of scrypt) of an ASIC would be the memory. Doubling the cycles means that you use twice as much memory for twice as much time, i.e., doubling the cycles makes a brute-force attack roughly 4 times as expensive.

What are the minimum system requirements to compute such a huge KDF on a desktop or mobile?

The parameters used in the example taking 3.8 seconds are $(N,r)=(2^{20},8)$. Theorem 2 of the scrypt paper says you need $128Nr$ bytes of memory, so the computer has to have at least 1 GiB of RAM.

Length is irrelevant. The cost of brute-forcing a password is determined by $(N,r)$ and the password's entropy.

• "Very important: This is the cost of finding the password within a year by building an ASIC in 2002." ... Or in case the attacker had around 20 computers (circa 2002 model or newer) laying around, the attacker could crack the 6 letter password in one year with them. (Assuming the parameters from scrypt paper.) Dec 17, 2013 at 19:30
• @user4982: You can try to brute-force a password with pretty much every programmable electronic device with enough memory, but the estimated costs of the slides (and paper) use 2002 ASIC technology. Dec 17, 2013 at 19:41
• True. I just wanted to highlight the fact that sufficient computing power is within reach of just about anybody and that you do not need to use ASIC or FPGA. Calculating cost in ASIC devices is bit inconvenient as custom ASIC devices are either made in huge quantities or they will in fact cost more than \$900 per device. Dec 17, 2013 at 19:49