How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. Otherwise with encryption algorithms like AES-256 it's the perfect size already.

Do I just manipulate the keylength of the second PBKDF2 output? If I'm correct, this technically wouldn't be SCRYPT anymore but just a close variant?

Would it be at all practical to use the SCRYPT hashing algorithm as the PRF in HKDF or PBKDF2 output?

I understand how to use it as an authentication hash but as a full fledged KDF perhaps I don't have the right code and documentation is extremely unclear to me.

  • 1
    $\begingroup$ Usually a KBKDF such as HKDF/HKDF-expand is simply bolted on top of the PBKDF such as SCRYPT (possibly using different labels). What's wrong with such a scheme? $\endgroup$ – Maarten Bodewes Apr 19 '17 at 0:07
  • 1
    $\begingroup$ Yes scrypt is specifically designed to derive keys longer than specific blocks. I would however not call it "unbound". RFC 7914: "The intended output length dkLen is the length in octets of the key to be derived ("keyLength"); it is a positive integer less than or equal to (2^32 - 1) * 32." $\endgroup$ – eckes Apr 20 '17 at 23:57

The signature for scrypt, straight from the source:

 * crypto_scrypt(passwd, passwdlen, salt, saltlen, N, r, p, buf, buflen):
 * Compute scrypt(passwd[0 .. passwdlen - 1], salt[0 .. saltlen - 1], N, r,
 * p, buflen) and write the result into buf.  The parameters r, p, and buflen
 * must satisfy r * p < 2^30 and buflen <= (2^32 - 1) * 32.  The parameter N
 * must be a power of 2 greater than 1.
 * Return 0 on success; or -1 on error.
int crypto_scrypt(const uint8_t *, size_t, const uint8_t *, size_t, uint64_t,
    uint32_t, uint32_t, uint8_t *, size_t);

The last argument (buflen) is the output size. You just give it the value you want (and that satisfies the requirements in the comment).

Given how simple this answer is, I would guess there's some missing context. Maybe you are using a third-party library that reimplements scrypt or links to the original, but does not provide this parameter for the caller to specify. In that case, well, then you have some options:

  1. Use a different library that provides the full range of options;
  2. Try to get the library patched to support the full range of options;
  3. Use a key-based key derivation function like HKDF-expand to expand the short scrypt output your library provides.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.