# Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. Otherwise with encryption algorithms like AES-256 it's the perfect size already.

Do I just manipulate the keylength of the second PBKDF2 output? If I'm correct, this technically wouldn't be SCRYPT anymore but just a close variant?

Would it be at all practical to use the SCRYPT hashing algorithm as the PRF in HKDF or PBKDF2 output?

I understand how to use it as an authentication hash but as a full fledged KDF perhaps I don't have the right code and documentation is extremely unclear to me.

• Usually a KBKDF such as HKDF/HKDF-expand is simply bolted on top of the PBKDF such as SCRYPT (possibly using different labels). What's wrong with such a scheme? – Maarten Bodewes Apr 19 '17 at 0:07
• Yes scrypt is specifically designed to derive keys longer than specific blocks. I would however not call it "unbound". RFC 7914: "The intended output length dkLen is the length in octets of the key to be derived ("keyLength"); it is a positive integer less than or equal to (2^32 - 1) * 32." – eckes Apr 20 '17 at 23:57

The signature for scrypt, straight from the source:

/**
* crypto_scrypt(passwd, passwdlen, salt, saltlen, N, r, p, buf, buflen):
* Compute scrypt(passwd[0 .. passwdlen - 1], salt[0 .. saltlen - 1], N, r,
* p, buflen) and write the result into buf.  The parameters r, p, and buflen
* must satisfy r * p < 2^30 and buflen <= (2^32 - 1) * 32.  The parameter N
* must be a power of 2 greater than 1.
*
* Return 0 on success; or -1 on error.
*/
int crypto_scrypt(const uint8_t *, size_t, const uint8_t *, size_t, uint64_t,
uint32_t, uint32_t, uint8_t *, size_t);


The last argument (buflen) is the output size. You just give it the value you want (and that satisfies the requirements in the comment).

Given how simple this answer is, I would guess there's some missing context. Maybe you are using a third-party library that reimplements scrypt or links to the original, but does not provide this parameter for the caller to specify. In that case, well, then you have some options:

1. Use a different library that provides the full range of options;
2. Try to get the library patched to support the full range of options;
3. Use a key-based key derivation function like HKDF-expand to expand the short scrypt output your library provides.