# Why don't we use bcrypt and scrypt together?

Everyone is comparing bcrypt to scrypt. Bcrypt is proven, lots of cryptoanalysis and no vulnerabilities so far, but uses very low memory. While scrypt uses a lot of memory, but it's too early in its life. Is there anything problematic by using them in cascade/together? Like scrypt the password then bcrypt the result. Eg.: bcrypt(scrypt(pwd))

Is this a problematic approach somehow or everyone just tries to solve one problem with one and only one KDF?

• Wouldn't such construction vulnerable to the Meet in the Middle Attack? – ddddavidee Oct 5 '14 at 16:37
• @ddddavidee: no, it wouldn't, as bcrypt (the outer transform) cannot be inverted. – poncho Oct 5 '14 at 16:56
• ah, yes! you should build a dictionary to inverse it (infeasible). thank you! – ddddavidee Oct 5 '14 at 16:57

• One minor nit-pick: bcrypt is not a key-derivation function. You cannot use bcrypt to, for example, generate 256 bits of key material. bcrypt always outputs 24-bytes (the result of encrypting OrpheanBeholderScryDoubt with Blowfish encryption). Scrypt on the other hand is a (password based) key derivation function; which people have used for password storage. – Ian Boyd Aug 14 '15 at 20:42