Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Am I wrong to think that scrypt(bcrypt(password)) would be better than using sole (s|b)crypt? Especially when considering two different key for the two algorithms.

I am also interested in some papers.

share|improve this question
6  
Cascading cryptographic algorithms is like picking herbs at random in a forest and making an infusion. Occasionally, this reproduces an efficient medication for some ailment. More often, the result will taste awful and make you ill. Sometimes it will kill you. Hence the standard warning: please refrain from doing it. –  Thomas Pornin Jul 31 '11 at 2:06
    
I know that I'll need to hide ciphertext patterns before algorithm switching. –  user871089 Jul 31 '11 at 2:51
    
Although his comment is metaphorical, Thomas is a respected expert on this site. If you want a better answer you will need to ask a question specifying entropy, key size, memory cost, computation cost, PRNG, or some combination thereof. Read scrypt and bcrypt and then ask again. –  this.josh Jul 31 '11 at 6:15
1  
Please edit your question to include all this research you have already done so people will not have to post all these side-comments. That is, prove to everybody you have already done your homework and you might get better answers. –  Nakedible Jul 31 '11 at 16:32
1  
@user871089 - please update your question with context. Without some idea of what you want to do with it, it can be very difficult to give answers. As it stands, I'm not sure whether it meets requirements for a good question... –  Rory Alsop Jul 31 '11 at 21:34
show 1 more comment

2 Answers

up vote 7 down vote accepted

scrypt(bcrypt(password)) will be less secure when considering the attack model scrypt is geared against - namely requiring as expensive hardware as possible for brute force attacks.

However, if you believe that the scrypt construction or the primitives used in scrypt (SHA256, Salsa20) are prone to failure, using bcrypt as well brings in another cryptographic primitive (blowfish). However, it might just as well be that there is absolutely no benefit.

In general, I would strongly advise against combining methods like this without actually understanding the ramifications and proving that some meaningful benefit is gained.

Edit: Oh, in case you didn't know, scrypt uses PBKDF2 both before and after its own method, which is probably the most widely used method for strong password hashing - certainly much more used than bcrypt.

Edit: Probably the closest cryptographic papers on the issue are those evaluating the combination of SHA1 and MD5 in the TLS PRF construction, such as: Hash Function Combiners in TLS and SSL.

share|improve this answer
    
Why is it less secure? –  D.W. Aug 1 '11 at 3:43
4  
scrypt is about maximizing memory usage within a certain amount of CPU time, hence maximizing the cost of creating hardware to crack the passwords. The amount of CPU time used is picked dynamically based on the system it is running on depending on usage (file encryption / interactive login / etc.) If combining scrypt and bcrypt together, not as much memory can be used in the same CPU-time, hence it is cheaper to produce hardware to crack the passwords, hence it is less secure with regard to the attack model chosen in scrypt. –  Nakedible Aug 1 '11 at 4:48
add comment

I'm not entirely sure about the policy here, but when something is almost less than a Google search away, should that really be put here as a question?

Determining if scrypt(bcrypt(password)) is better than sole (s|b)crypt depends entirely on your definition for "better".

  • Should it take longer to derive?
  • Should key derivation be stronger, or more complex?

While I certainly make no claims to be even remotely competent or experienced with cryptography, combining them would to me appear to be stronger rather than using them on their own.

Paper on Scrypt key derivation

share|improve this answer
    
Ok, I knew that people here will expect that I am banned in Google :) My point is: scrypt is relatively new, and as far as I know is not tested as extensively as bcrypt. So I thought if we can combine them, it will protect at least from scrypt cracking. –  user871089 Jul 30 '11 at 23:50
    
Well, I do agree that since it's new there may be flaws that have yet to be discovered. Cryptography certainly is not something an amateur should dabble with. I think your concern is valid, but I don't have the knowledge to judge whether scrypt is better than bcrypt. Having read through the paper mentioned above, it certainly seems good enough. Guess only time will tell. –  Christoffer Jul 31 '11 at 9:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.