4
$\begingroup$

When you use scrypt to hash a string, it will generate something like:

SCRYPT:4096:8:1:8zCQhTI8y2pdrFeIj2WYBJIbaLiePLOuXdbevG7XDV4qgUuiGPCXPFjh1aEmXQ/5u+SlCvz0KkcoOJtUWBkytfkCs2OZep60W+Nagv0gixqkcMn/PxoIqnOGIzyDWntEdsQKjYBHDYK5Va5VDHqoQxJeIm+yq3lJ4/y5dnL55RA=:zABi6opzkXwG627OUrk4KNUCiajY1xdM+PVmSC+VJS8=

The first part: SCRYPT:4096:8:1: is the "header" (identification and parameters used).

The second part: 

zCQhTI8y2pdrFeIj2WYBJIbaLiePLOuXdbevG7XDV4qgUuiGPCXPFjh1aEmXQ/5u+SlCvz0KkcoOJtUWBkytfkCs2OZep60W+Nagv0gixqkcMn/PxoIqnOGIzyDWntEdsQKjYBHDYK5Va5VDHqoQxJeIm+yq3lJ4/y5dnL55RA=`

I believe is the actual hash (b64 encoded).

What is the last part? zABi6opzkXwG627OUrk4KNUCiajY1xdM+PVmSC+VJS8=, the salt?

UPDATE

I found this question: https://security.stackexchange.com/questions/88678/why-does-node-js-scrypt-function-use-hmac-this-way/91050#91050

bytes 0-5: The word "scrypt"
bytes 6-15: Scrypt parameters N, r, and p
bytes 16-47: 32 bits of random salt
bytes 48-63: A 16 bit checksum
bytes 64-95: A 32 bit HMAC of bytes 0 to 63 using a key produced by the scrypt key derivation function.

To my understanding, it describes the first and second part of the resulting string described previously. Unless I'm mistaken, the last part is not discussed there.

Bottom line

As commented by Maarten Bodewes, I have found that not all libraries will output the same string as I posted above. That one is specific for the Perl library I'm using (I was unaware of that). For example, take a look to these implementations, and you will see the hash doesn't look like that:

Improve this question
$\endgroup$
  • 1
    $\begingroup$ Is this about scrypt, the command line utility? What software do you use for this? In principle scrypt is an algorithm that outputs a password hash (or, by another name, a derived key). The format is specific for the tool you're using. Salt-then-hash is more logical by the way; a salt can have any size while the resulting hash is probably smaller, say, 32 bytes (exactly the size of the last base 64 "chunk"). Generally, e.g. for bcrypt, the hash is last. $\endgroup$ – Maarten Bodewes♦ Jun 27 '16 at 13:24
  • $\begingroup$ @MaartenBodewes: I'm using perl Crypt::ScryptKDF. I normally use BCrypt (PHP, C++, Perl, Java...) so I'm not so familiar with scrypt. I'm also confused, is the above a rfc2307 hash (cause it doesn't look like)? $\endgroup$ – lepe Jun 28 '16 at 4:59
  • 2
    $\begingroup$ @lepe Your update gives sizes in bits, when it clearly should be bytes. $\endgroup$ – CodesInChaos Jun 28 '16 at 6:50
3
$\begingroup$

I should have started here:

sub scrypt_hash {
  my ($key, $salt, $N, $r, $p) = _scrypt_extra(@_);
  return undef unless defined $key && defined $salt && defined $N && defined $r && defined $p;
  return "SCRYPT:$N:$r:$p:" . MIME::Base64::encode($salt, "") . ":" . MIME::Base64::encode($key, "");
}

It explains that the last chunk is actually the base64 encoded key (hashed password). The second part (which I thought was the hashed password), is actually the base64 encoded salt.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.