Questions tagged [scrypt]

A slow and memory-intensive hash function designed for passwords

Filter by
Sorted by
Tagged with
19
votes
2answers
13k views

What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
14
votes
2answers
1k views

How to derive two keys from one password

What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this?
11
votes
3answers
2k views

How well does scrypt perform on different architectures / OSes?

The scrypt algorithm seems to be a prominent feature in the "CPU friendly" Bitcoin clones for the proof-of-labor part. I've heard claims that it's relatively slow on Windows and/or Intel compared to ...
11
votes
1answer
6k views

argon2 vs scrypt

It's a fact that scrypt and argon2 are the two dominant memory hard KDFs. But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost ...
10
votes
4answers
11k views

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded. But most "secure" crypto hashes (KDF' ) like ...
10
votes
1answer
7k views

Should I use SHA256 or Blake2 to checksum and sign scrypt headers?

I use scrypt as a key derivation function (not to store passwords). To pass around the detached key header I use the standard encoding as implemented in Colin Percival's scrypt implementation (...
9
votes
2answers
5k views

Appropriate scrypt parameters when generating an scrypt hash

What values for CPU, memory and parallel difficulty should be used when generating an scrypt hash? i.e. ...
8
votes
4answers
4k views

How does Scrypt use Salsa?

Bcrypt uses Blowfish to encrypt a derived key from the passphrase, and Blowfish is a cryptographic algorithm, but here it is said that: Note that Salsa20/8 Core is not a cryptographic hash ...
8
votes
1answer
2k views

How can scrypt be improved to counter GPU mining

I know scrypt was designed to lessen the GPU/ASIC advantage. We now have litecoin as a real-world example of this. However, it hasn't worked out perfectly. Most coins are mined by GPUs, although the ...
7
votes
2answers
646 views

Scrypt not “old enough” to be safe?

I just check all the questions with scrypt tag about that and usually it's said that scrypt is nice in theory and theoretically better than bcrypt and PKDF2, but it's too young to be "completely safe"....
7
votes
1answer
12k views

GPG vs PGP vs OpenSSH and management of them [closed]

What is the main difference of the three? Can I use only one of them for everything (e.g. GPG for SSH authentication) If I encrypt my private key with a pass-phrase, is it strong enough so that if ...
7
votes
1answer
340 views

Is there any known malleability of scrypt outputs?

The scenario is single-use passphrase-based non-interactive message authentication. The obvious try to do this is to chose a random salt of the appropriate length and send: ...
6
votes
0answers
102 views

Is Argon2 “sequential memory hard”?

The Scrypt paper here defines memory-hard and sequential memory hard functions as follows: Definition 1. A memory-hard algorithm on a Random Access Machine is an algorithm which uses $S(n)$ space and ...
5
votes
1answer
600 views

Why don't we use bcrypt and scrypt together?

Everyone is comparing bcrypt to scrypt. Bcrypt is proven, lots of cryptoanalysis and no vulnerabilities so far, but uses very low memory. While scrypt uses a lot of memory, but it's too early in its ...
5
votes
1answer
294 views

Is there a reason that the N value in scrypt is limited to powers of two?

I have been looking at the scrypt hashing algorithm and am confused as to why the N value, which determines the overall cost, is limited to powers of two. There are ...
5
votes
1answer
640 views

Key collision in scrypt and hkdf

I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) ...
5
votes
1answer
318 views

Is there a tangible benefit in keeping the number of PBKDF iterations secret and not storing them with the ciphertext?

Suppose I have a local file and it is encrypted with a symmetric key derived from a strong passphrase, unique salt and $x$ number of PBKDF (e.g. Scrypt) iterations. I am interested in keeping this ...
5
votes
1answer
328 views

How does blockmix in scrypt work? What is the meaning of the H function in scrypt?

I am trying to understand how scrypt works. I am referring to the Algorithm section of scrypt's Wikipedia page. There I find ...
5
votes
1answer
185 views

Login security and plaintext of a password stored in Argon2i to derive a key via halite safe?

I'm using Symfony 4. I have set parameters on all my Argon2 stuff below so that it takes 1s per iteration. This website is supposed to encrypt HIPAA information. Basically I have a table like this <...
4
votes
1answer
686 views

Using scrypt to generate key + IV/nonce together

Is there any security issue in using scrypt for Key + IV/nonce generation? In other words, can I safely use only a salt for scrypt and derive the nonce along with the key? For example: I have data I ...
4
votes
1answer
453 views

How to adjust scrypt parameters for Moore's Law?

I have been examining the scrypt paper, and I noted the claims in table 1. For 10 random ASCII characters, the cost at that time for scrypt set to $(2^{14}, 8, 1)$ is estimated to be $175T/yr. Can ...
4
votes
1answer
520 views

What do the last chunks of the output string of Scrypt contain?

When you use scrypt to hash a string, it will generate something like: ...
4
votes
1answer
922 views

A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt

I want a key stretching system that's as strong as the stronger of scrypt and PBKDF2. The consensus now is that scrypt is by far the better system, but that might change if in the future, a weakness ...
3
votes
2answers
2k views

Is scrypt a hashing function, encryption, or PBKDF?

I have installed a python implementation of scrypt and noticed it has several functions, both an encrypt and hash function. Yet Wikipedia lists it as being used for PBKDF instead of PBKDF2. Is scrypt ...
3
votes
1answer
556 views

If and why is it bad to scrypt a bcrypted password?

This has been already brought up on security SE, but very sadly, this particular interesting issue got watered down in a far broader question. If and why is it bad to use the following hashing ...
3
votes
1answer
4k views

Bcrypt VS Scrypt, Again?

I found this article on SO, but the answer was short, and the subject was closed, What i don't understand, is: Which one of the two limits memory usage to avoid custom Hardware to break the password? ...
3
votes
1answer
101 views

How much information do I leak if I upload multiple ciphertexts with cleartext overlaps?

Suppose that $t_1, t_2, \ldots, t_n$ are my clear texts. Suppose that for any $(i,j) \in \{1,2,\ldots,n\}^2$, $t_i$ and $t_j$ only differ in, say, the 1st $m$-many characters. Finally, suppose that I ...
3
votes
2answers
155 views

Public SRP verifiers or public hash chain “public keys” when secret is low entropy password

I want to set up the following: An untrusted server should host user sessions and authenticate users without knowing their passwords or being capable of creating a fake user session in the user's ...
3
votes
2answers
338 views

Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory?

I'm unsure of how exactly the salt is manipulated by scrypt and its potential contribution if any to overall password entropy if passwords & salts are stored only in human memory for a ...
3
votes
0answers
112 views

Attacking Scrypt Under Access Pattern Leakage

Could cache-timing channels (such as exist for certain block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...
2
votes
1answer
551 views

Strange Password Hashing

I know about PBKDF2, bcrypt, scrypt, etc. and while I'm not a crypt professional, I think I understand why are they better than just "hash(pass+salt)". But a colleague of mine surprised me with the ...
2
votes
2answers
1k views

AES key expansion vs. a hash

Is there something special about the AES key expansion algorithm that makes it secure, or it is a compromise between security and speed? For example, say with a key I expand it by taking pbkdf2(key) ...
2
votes
2answers
180 views

Is this correct/incorrect password for file encryption scheme secure?

I'm writing an AES file encryption program, and I'd like to put in a way to tell whether or not the user has entered the correct password without decrypting the entire file and GCM telling me the tag ...
2
votes
1answer
998 views

HKDF: ikm, salt and info values

As indicated at Key generation for AES-GCM-256 file encryption I'm currently working on a file encryption software. In the above thread it was suggested that, for performance reasons, I use a ...
2
votes
1answer
162 views

How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...
2
votes
1answer
329 views

Is it safe to reuse the same nonce for decryption an indefinite amount of times in this context?

I'm creating a password management application and I'm considering using the following procedure to keep passwords safe: Asking the user for raw_password, for ...
2
votes
1answer
499 views

Would it be better to use HKDF or SCrypt for deriving a child key?

Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure. Mp: The master key pair, this includes a ...
2
votes
1answer
1k views

PBKDF2 for login key, scrypt for encryption key

I need to derive two keys from a single password client side. One for in-browser login, the other for encryption. Is the following secure ? ...
2
votes
1answer
144 views

Is concatenated data hashed with scrypt vulunarable to a length extension attack?

scrypt takes a salt, and a password plus some cost paramters to generate a key. So say we define it as this: key = scrypt(password, salt, cost) I am interested ...
1
vote
2answers
1k views

Password Hashing Security Using Scrypt & Argon2

I am developing an app where the following cryptographic system will be in place: Elliptic Curve key exchange (curve: secp521r1) Double Scrypt the shared secret with different salts Pass this result ...
1
vote
4answers
1k views

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply ...
1
vote
2answers
265 views

How resilient to attackers with extreme resources available is this encryption method?

How could the following scheme be made more resilient to attacks capable of utilizing massive amounts of resources? Assume all random values are cryptographically secure. Key derivation: scrypt ...
1
vote
1answer
207 views

Is it safe to reuse the password when using AES-CTR with scrypt?

I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does: ...
1
vote
1answer
280 views

What does “sequential memory-hard” mean?

I found this term in Scrypt's paper. I have several questions about its meaning, ranging from how to parse it, to theoretical bounds: Q1: How to parse it? Is it read ...
1
vote
2answers
292 views

Key derivation: bit lengths

This is a follow-up question to HKDF: ikm, salt and info values Based on the feedback, I have now decided to implement my key derivation for AES-GCM-256 file encryption roughly as follows: ...
1
vote
2answers
674 views

scrypt and bcrypt for benefits of both?

I've been reading about bcrypt and scrypt, and it seems that the general consensus is that bcrypt is more "tried and true", but scrypt is better in theory. Couldn't you just hash something with ...
1
vote
2answers
55 views

is it safe to combine scrypt with other hash algorithms?

I'm currently writing a file encryption program, and I designed this scheme to derive a key from user input password: ...
1
vote
1answer
238 views

How to make my hash more robust to the brute force?

I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret. I want to increase the cost of brute forcing the passphrase I use to generate the secret. I'm thinking of using scrypt after ...
1
vote
1answer
46 views

Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
1
vote
1answer
413 views

Scrypt as a KDF with one-time high-entropy input

I'm looking at using Scrypt as a KDF. Assume the following: the input will always be high-entropy random bytes generated by a CSPRNG the length of the input can vary from between 8 to 32 bytes the ...