# Is it safe to reuse the password when using AES-CTR with scrypt?

I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does:

scrypt encrypted data format
----------------------------

offset  length
0   6   "scrypt"
6   1   scrypt data file version number (== 0)
7   1   log2(N) (must be between 1 and 63 inclusive)
8   4   r (big-endian integer; must satisfy r * p < 2^30)
12  4   p (big-endian integer; must satisfy r * p < 2^30)
16  32  salt
48  16  first 16 bytes of SHA256(bytes 0 .. 47)
64  32  HMAC-SHA256(bytes 0 .. 63)
96  X   data xor AES256-CTR key stream generated with nonce == 0
96+X    32  HMAC-SHA256(bytes 0 .. 96 + (X - 1))

AES256-CTR is computed with a 256-bit AES key key_enc, and HMAC-SHA256 is
computed with a 256-bit key key_hmac, where
scrypt(password, salt, N, r, p, 64) == [key_enc][key_hmac]


Can I safely reuse the password for encrypting different files? I'm concerned that nonce is set to 0 and I know that reusing the key in the CTR mode is a big no-no. However, the key is generated by scrypt, which uses randomly generated salt. Is that enough to mitigate the problems with reusing the passphrase and having a fixed nonce?

• – kelalaka Aug 19 '19 at 17:31