New answers tagged scrypt
Each block of the output of PBKDF2 is derived independently of all the other blocks. Because of this, computing a large output on a massively parallel system (such as a GPU) is very efficient. Further, if you only take certain bytes of the output and discard the rest, an attacker only needs to compute the blocks containing those bytes.
We can't "also make PBKDF2 use a lot of memory by simply asking it for a large output (and taking the bytes we actually need from the end of output, discarding the rest)" because PBKDF2 can essentially stream its output.
SCrypt's memory usage comes from its use of a long list of psuedo-random numbers. Since this list is pseudo-random, there are two ways of dealing with it: Pre-compute the entire list and store it in memory. Since each element is expected to be accessed many times, this reduces the CPU cost but increases the memory cost. Compute each list element on an ...
Top 50 recent answers are included