Basic scrypt question

Question

Suppose we throw a regular password into scrypt to generate some data. Scrypt allows us to specify how large the output data should be.

My question is, to take an extreme case, if we ask for a 1 GB data from scrypt, would it be possible somehow quickly to generate the final bytes of this output from the first bytes?

In other words, is there a threshold "x bytes" at which I "should probably not ask scrypt for more than x bytes"?

Update: Let me put it a different way: If I tell scrypt to produce 1 GB of data, make the first x bytes of the result available to the public, and use the final 48 bytes (as key and IV) to encrypt sensitive data using AES-256-CBC, am I in trouble? Trouble, in the sense that I have defeated the purpose of using scrypt? Does the answer depend on x?

Answer 1

You should not ask for more output from scrypt than you need. The CPU/memory cost of scrypt hashing is not dominated by the output size, but rather by the setup process (in Wikipedia's explanation of the algorithm, the values "N" (CPU/memory cost) and "p" (parallelization parameter)). The output is generated by a single iteration of PBKDF2, using the values from the setup phase of scrypt as the salt.

For the same reason, generating partial output (say, the last few bytes) is only marginally faster than generating the entire output: it's possible to generate only selected subsets of the output of PBKDF2 at low cost, but you need the entire input to be available to do this.

PBKDF2 generates its output as a series of blocks by concatenating and iteratively hashing the password, seed, and 32-bit block number. For output of less than 2^32-1 blocks (128 GB for PBKDF2 as used by scrypt), revealing part of the output has no impact on the security of the rest of the output. After that point, however, the output starts repeating itself.