# is it safe to leak some information about scrypt result?

I am encrypting a file via AES-CBC and am using scrypt to extract a key from a user-provided password. The IV is public and is stored with the encrypted file.

Is it safe to generate my IV (public) and key (private) together using scrypt (e.g. set dklen=64 then use scrypt[0...31] for key and scrypt[32...63] for IV), or will I be leaking some kind of state information?

• Regarding the second paragraph: what's suggested is common an practically safe; but in AES-CTR with single-use key, using fixed nonce rather than random makes possible a multi-target attack assuming known (e.g.) first block of $n$ plaintexts: we try keys (e.g. sequentially), encipher the fixed nonce, and search the result among the $n$ known first block of keystream. Compared to random nonce, $n-1$ AES encryptions get replaced by a search among $n$ values. – fgrieu May 3 '18 at 18:47