I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does:

scrypt encrypted data format

offset  length
0   6   "scrypt"
6   1   scrypt data file version number (== 0)
7   1   log2(N) (must be between 1 and 63 inclusive)
8   4   r (big-endian integer; must satisfy r * p < 2^30)
12  4   p (big-endian integer; must satisfy r * p < 2^30)
16  32  salt
48  16  first 16 bytes of SHA256(bytes 0 .. 47)
64  32  HMAC-SHA256(bytes 0 .. 63)
96  X   data xor AES256-CTR key stream generated with nonce == 0
96+X    32  HMAC-SHA256(bytes 0 .. 96 + (X - 1))

AES256-CTR is computed with a 256-bit AES key key_enc, and HMAC-SHA256 is
computed with a 256-bit key key_hmac, where
  scrypt(password, salt, N, r, p, 64) == [key_enc][key_hmac]

Can I safely reuse the password for encrypting different files? I'm concerned that nonce is set to 0 and I know that reusing the key in the CTR mode is a big no-no. However, the key is generated by scrypt, which uses randomly generated salt. Is that enough to mitigate the problems with reusing the passphrase and having a fixed nonce?


1 Answer 1


CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero IV. Of course, the password must be strong enough to resist brute force attacks.

  • 2
    $\begingroup$ This paper supports this answer. (It explicitly says that deterministic encryption is fine for salt-randomizing password-based encryption) $\endgroup$
    – SEJPM
    Aug 19, 2019 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.