2 added 371 characters in body
source | link

You should not ask for more output from scrypt than you need. The CPU/memory cost of scrypt hashing is not dominated by the output size, but rather by the setup process (in Wikipedia's explanation of the algorithm, the values "N" (CPU/memory cost) and "p" (parallelization parameter)). The output is generated by a single iteration of PBKDF2, using the values from the setup phase of scrypt as the salt.

For the same reason, generating partial output (say, the last few bytes) is only marginally faster than generating the entire output: it's possible to generate only selected subsets of the output of PBKDF2 at low cost, but you need the entire input to be available to do this.

PBKDF2 generates its output as a series of blocks by concatenating and iteratively hashing the password, seed, and 32-bit block number. For output of less than 2^32-1 blocks (128 GB for PBKDF2 as used by scrypt), revealing part of the output has no impact on the security of the rest of the output. After that point, however, the output starts repeating itself.

You should not ask for more output from scrypt than you need. The CPU/memory cost of scrypt hashing is not dominated by the output size, but rather by the setup process (in Wikipedia's explanation of the algorithm, the values "N" (CPU/memory cost) and "p" (parallelization parameter)). The output is generated by a single iteration of PBKDF2, using the values from the setup phase of scrypt as the salt.

For the same reason, generating partial output (say, the last few bytes) is only marginally faster than generating the entire output: it's possible to generate only selected subsets of the output of PBKDF2 at low cost, but you need the entire input to be available to do this.

You should not ask for more output from scrypt than you need. The CPU/memory cost of scrypt hashing is not dominated by the output size, but rather by the setup process (in Wikipedia's explanation of the algorithm, the values "N" (CPU/memory cost) and "p" (parallelization parameter)). The output is generated by a single iteration of PBKDF2, using the values from the setup phase of scrypt as the salt.

For the same reason, generating partial output (say, the last few bytes) is only marginally faster than generating the entire output: it's possible to generate only selected subsets of the output of PBKDF2 at low cost, but you need the entire input to be available to do this.

PBKDF2 generates its output as a series of blocks by concatenating and iteratively hashing the password, seed, and 32-bit block number. For output of less than 2^32-1 blocks (128 GB for PBKDF2 as used by scrypt), revealing part of the output has no impact on the security of the rest of the output. After that point, however, the output starts repeating itself.

1
source | link

You should not ask for more output from scrypt than you need. The CPU/memory cost of scrypt hashing is not dominated by the output size, but rather by the setup process (in Wikipedia's explanation of the algorithm, the values "N" (CPU/memory cost) and "p" (parallelization parameter)). The output is generated by a single iteration of PBKDF2, using the values from the setup phase of scrypt as the salt.

For the same reason, generating partial output (say, the last few bytes) is only marginally faster than generating the entire output: it's possible to generate only selected subsets of the output of PBKDF2 at low cost, but you need the entire input to be available to do this.