8

Am I wrong to think that scrypt(bcrypt(password)) would be better than using sole (s|b)crypt? Especially when considering two different key for the two algorithms.

I am also interested in some papers.

Improve this question
6
  • 8
    Cascading cryptographic algorithms is like picking herbs at random in a forest and making an infusion. Occasionally, this reproduces an efficient medication for some ailment. More often, the result will taste awful and make you ill. Sometimes it will kill you. Hence the standard warning: please refrain from doing it.
    – Thomas Pornin
    Commented Jul 31, 2011 at 2:06
  • I know that I'll need to hide ciphertext patterns before algorithm switching.
    – user871089
    Commented Jul 31, 2011 at 2:51
  • Although his comment is metaphorical, Thomas is a respected expert on this site. If you want a better answer you will need to ask a question specifying entropy, key size, memory cost, computation cost, PRNG, or some combination thereof. Read scrypt and bcrypt and then ask again.
    – this.josh
    Commented Jul 31, 2011 at 6:15
  • 1
    Please edit your question to include all this research you have already done so people will not have to post all these side-comments. That is, prove to everybody you have already done your homework and you might get better answers.
    – Nakedible
    Commented Jul 31, 2011 at 16:32
  • 1
    @user871089 - please update your question with context. Without some idea of what you want to do with it, it can be very difficult to give answers. As it stands, I'm not sure whether it meets requirements for a good question...
    – Rory Alsop ♦
    Commented Jul 31, 2011 at 21:34

2 Answers 2

Reset to default
9

scrypt(bcrypt(password)) will be less secure when considering the attack model scrypt is geared against - namely requiring as expensive hardware as possible for brute force attacks.

However, if you believe that the scrypt construction or the primitives used in scrypt (SHA256, Salsa20) are prone to failure, using bcrypt as well brings in another cryptographic primitive (blowfish). However, it might just as well be that there is absolutely no benefit.

In general, I would strongly advise against combining methods like this without actually understanding the ramifications and proving that some meaningful benefit is gained.

Edit: Oh, in case you didn't know, scrypt uses PBKDF2 both before and after its own method, which is probably the most widely used method for strong password hashing - certainly much more used than bcrypt.

Edit: Probably the closest cryptographic papers on the issue are those evaluating the combination of SHA1 and MD5 in the TLS PRF construction, such as: Hash Function Combiners in TLS and SSL.

Improve this answer
3
  • 2
    Why is it less secure?
    – D.W.
    Commented Aug 1, 2011 at 3:43
  • 6
    scrypt is about maximizing memory usage within a certain amount of CPU time, hence maximizing the cost of creating hardware to crack the passwords. The amount of CPU time used is picked dynamically based on the system it is running on depending on usage (file encryption / interactive login / etc.) If combining scrypt and bcrypt together, not as much memory can be used in the same CPU-time, hence it is cheaper to produce hardware to crack the passwords, hence it is less secure with regard to the attack model chosen in scrypt.
    – Nakedible
    Commented Aug 1, 2011 at 4:48
  • 1
    karjalanpiirakka ja kalakukko ja Suomi ja Kalevala ja rössypottu :)
    – user45139
    Commented Oct 24, 2015 at 5:26
0

I'm not entirely sure about the policy here, but when something is almost less than a Google search away, should that really be put here as a question?

Determining if scrypt(bcrypt(password)) is better than sole (s|b)crypt depends entirely on your definition for "better".

  • Should it take longer to derive?
  • Should key derivation be stronger, or more complex?

While I certainly make no claims to be even remotely competent or experienced with cryptography, combining them would to me appear to be stronger rather than using them on their own.

Paper on Scrypt key derivation

Improve this answer
2
  • Ok, I knew that people here will expect that I am banned in Google :) My point is: scrypt is relatively new, and as far as I know is not tested as extensively as bcrypt. So I thought if we can combine them, it will protect at least from scrypt cracking.
    – user871089
    Commented Jul 30, 2011 at 23:50
  • Well, I do agree that since it's new there may be flaws that have yet to be discovered. Cryptography certainly is not something an amateur should dabble with. I think your concern is valid, but I don't have the knowledge to judge whether scrypt is better than bcrypt. Having read through the paper mentioned above, it certainly seems good enough. Guess only time will tell.
    – Christoffer
    Commented Jul 31, 2011 at 9:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .