People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply telling me where I'm wrong.
Okay, let's say I'm Google and want to hash my user's passwords in the most secure way possible. Currently some of the most recommended ways are PBKDF2 (with SHA512 for example) and scrypt.
I want each password to take around 1 second to hash.
I look into PBKDF2 and see that the most efficient way to calculate hashes for it are using an ASIC.
I then look at Scrypt and see that the most efficient way to calculate hashes for it are through a balanced combination of CPU, RAM, and GPU.
Since I'm a webserver, I mostly just need CPU. I don't really need a GPU at all, only some RAM, but yeah, mostly CPU. Unfortunately, I can't even use that much CPU because I need it for serving all my concurrent requests. As a result my hashing will be weaker unless I purchase additional hardware.
In the case of PBKDF2, you will need to buy an ASIC to be ideal, and with Scrypt you will need to buy a GPU, RAM, and have a really strong CPU (yikes recent Intel security issues) to be ideal.
Is there a difference is between having X input rounds with PBKDF2 with ideal hardware (ASIC) vs having Y input rounds with Scrypt with ideal hardware (Proper balance of CPU, RAM, and GPU)? Assuming both operations take 1 second with the given input parameters, at that point aren't you mostly just guessing which will be harder in the future?
Also, it looks like either way you'll need to spend money on additional hardware.
Okay, now for my additional arguments in favor of PBKDF2:
- It's been around longer and is thus more time-tested and scrutinized
- It's NIST and FIPS compliant
- There is more native support for it (For example, node crypto has PBKDF2 and not scrypt)
Also, an insane amount of financial incentive has lead to the development of specialized hardware for grinding PBKDF2 hashes because of the cryptocurrency phenomena. As a result, I'd imagine that not only is SHA extremely secure, but that ASICs are near the asymptote for potential performance.
Comparably, Scrypt may yet have specialized hardware developed that will allow for much more efficient computation in the future.
Lastly, is it not the case that Scrypt databases can be cracked by a botnet? Since the ideal hardware for the Scrypt hashing algorithm is pretty close to consumer hardware (CPU, GPU, RAM), is there not a risk that an Scrypt database could be be parallelized across the Botnet? For example, it is currently a concern of some cryptocurrencies that use Scrypt-adjacent algorithms that a botnet may be able to someday near a 51% attack.