Background information: Master password is a stateless password manager. It (deterministically) generates a password using a hash function, depending on your master password and the site name (also some other fields, but these aren't important for this question).
So if you remember your master password and the site name (and some small details) than you can generate the password for your site's account everytime, without storing passwords (encrypted or not) somewhere on your computer (which needs backups) or in the cloud (which means you need to trust an additional third party).
It generates a password in two parts:
- Part 1:
scrypt_key = scrypt(password + some salts + other details)
. - Part 2:
sha256(scrypt_key + site name + other details)
.
This last part is then used (pretty printed, not binary) for a site's password.
For the detailed version, see the page on the algorithm: http://masterpasswordapp.com/algorithm.html.
My actual question is then: What are the consequences of using sha rather than scrypt for the second part? They obviously know of the existence of scrypt, so why didn't they use it for the second part as well?
The only reason that I can think of why using sha for the second part is that if an attacker finds a collision, then the found collision is probably not the one he needs (e.g. sha256("abcdef")
accidentally equals sha256(scrypt_key + ...)
).