# Scrypt KDF cipher (scrypt CLI) - known vulnerabilities and cryptanalysis?

There is a scrypt cipher that is used for example by some cryptos like LItecoin for their mining algorithm.

I never heard of scrypt. I know eg SHA-256 which is well analyzed and considered as secure until now.

1. Any known cryptanalysis for scrypt / vulnerabilities?

2. is scrypt considered in the community as a secure (comparable to sha256) cipher?

3. How collision-resistant is it?

4. Is it easily breakable by quantum computing attacks?

## scrypt

scrypt is actually a password-based key derivation function (PBKDF *) created by Colin Percival; Stronger Key Derivation via Sequential Memory-Hard Functions. We want slower PBKDF functions since it will slow the attack times. The below is from hashcat performance;

scrpyt                         1172.8 kH/s (16.61ms)
PBKDF2-HMAC-MD5               18059.2 kH/s (69.72ms)


It is slower and designed against large-scale custom hardware attacks (ASIC,FPGA, and GPU) by requiring a large amount of memory. Internally uses PBKDF2 and Salsa20/8.

1. Any known cryptanalysis for scrypt / vulnerabilities?

The attackers cannot reverse the scrypt to find a pre-image. The only meaningful way is the password cracking by trying all possible passwords up to some length, checking the common password list, and trying combinations, or various other methods. If you want to mitigate this, you need to use a password with good entropy. You can generate one using diceware ( also EFF has a nice diceware page) or Bip39 or some other system that generates password with good entropy.

is scrypt considered in the community as a secure (comparable to sha256) cipher?

SHA256 is not a cipher, it is a hash function. You can also use SHA256 for KDF however not advised. The KDFs are designed for these purposes. For hash functions, we consider the pre-image, secondary pre-image, and collision resistance. For KDF functions the collision resistance or the collision attacks are not related.

There are no attacks on scrypt except for the first item.

1. How collision-resistant is it?

Not related.

1. Is it easily breakable by quantum computing attacks?

Hardly, since the number of q-bits will be much higher than AES. The main reason will be a large memory. If ever built, it will use Grover's algorithm.

## scrypt CLI program.

In short, scrypt CLI program uses AES256-CTR for encryption and HMAC_SHA256 for integrity and authentication. Little details;

• AES with the key size 128 bits resisted attacks even after nearly 22 years and practically still secure [1] [2] but vulnerable to multi-target attacks. From the code, as we can see, they use a 32-byte key, i.e AES256. That is even secure against Grover's quantum search [3].
• CTR mode requires a nonce (number used once), and should not be repeated. Once reused, it will be vulnerable to the two-time pad.
• HMAC is Hash-based Message Authentication Code here initiated with SHA256. It's security proven by Bellare, Mihir (June 2006). New Proofs for NMAC and HMAC: Security without Collision-Resistance under the assumption that the compression function is PRF.

* : don't confuse with PBKDF1 in rfc 8018

• @FutureSecurity I took my copies :) – kelalaka Jan 15 at 18:46