I'm trying to implement the scrypt key derivation function using JavaScript. When implementing the algorithm, I found that there was a function called SHA1_Compress listed in the specification. Is the function identical to a normal SHA-1 hash function? Or it is a totally different thing? I tried to search the term with Google but found nothing.

scrypt specification

  • $\begingroup$ By the way, you know the algorithm you quoted is not scrypt, right? It's another key derivation called HEKS, an early attempt in the late '90s to make a memory-hard algorithm which apparently nobody ever used. $\endgroup$ – Squeamish Ossifrage Feb 17 '19 at 21:47
  • $\begingroup$ @SqueamishOssifrage Oops, actually I haven't finished reading the paper. And implementing the wrong algorithm... $\endgroup$ – JasonHK Feb 18 '19 at 4:33
  • $\begingroup$ You might find it easier to start from the RFC: tools.ietf.org/html/rfc7914 It should be more or less self-contained, and includes test vectors for the whole algorithm and the various subroutines. $\endgroup$ – Squeamish Ossifrage Feb 18 '19 at 5:08

The function SHA-1 is defined on a message $m$ that is a sequence of bits. It works as follows—this form is named Merkle–Damgård after the people who suggested it in days of yore:

  1. Let $m' = m \mathbin\| 1 \mathbin\| 0^p \mathbin\| \operatorname{length}(m)$ be the result of padding $m$ with a one bit, $p$ zero bits, and a 64-bit message length, so that the length of $m'$ is an integral multiple of 512 bits.
  2. Break $m'$ into 512-bit blocks $m_1, m_2, \dots, m_n$.
  3. Compute $f(\cdots f(f(\mathit{iv}, m_1), m_2)\cdots, m_n)$.

Here $f\colon \{0,1\}^{160} \times \{0,1\}^{512} \to \{0,1\}^{160}$ is the compression function which compresses a 160-bit starting state and a 512-bit block into a 160-bit subsequent state, and $\mathit{iv}$ is the standard initialization vector.

In the case of SHA-1, the compression function is $f(h, m) := E_m(h) + h$ where $E_k$ is the SHACAL-1 block cipher—building $f$ out of a block cipher this way is called the Davies–Meyer construction.

The procedure SHA1_Compress computes $f$, the compression function that SHA-1 is built out of. Since the $w_i$ are initialized as an output of SHA-1 itself, another way to look at the procedure described here is as an incremental computation of SHA-1—you might use a typical init/update/finalize style of API for this—which periodically treats the current state as a hash itself, which works because SHA-1 has no output filter.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.