Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [scrypt]

Scrypt is a recent key derivation function designed for password storage. It aims to improve on earlier similar functions such as PBKDF2 and bcrypt by requiring significant amounts of memory in addition to computation time.

1
vote
0answers
65 views

Is it possible decrypt Android 8 encryption, if the device encryption key is gone (but with a known PIN and KEK)?

main question is in the title. Some clarification though: When you factory reset your encrypted phone, the old device encryption key (DEK a) gets deleted and a new encryption key (DEK b) is being ...
34
votes
1answer
11k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
1
vote
1answer
129 views

Concerns regarding a password manager web app [closed]

I've written a password manager in JavaScript. It works in a browser. Try it out Are there any fundamental issues with the concept of a web based password manager? Should I be concerned if hashes ...
-1
votes
2answers
6k views

How Facebook hashes passwords

I found this presentation how Facebook stores customer passwords and how they do authentication. This slide shows how they hash passwords: Is it a good idea to do such operations with a raw password?...
3
votes
0answers
75 views

Salt in argon2d as proof-of-work algorithm

I want to use argon2d as a proof-of-work algorithm. But as I know I can't use the algorithm without salt? Should I use a static salt for every task or generate new? Is it possible to increase ...
1
vote
3answers
113 views

Password hashes with large internal state

scrypt was designed to use a lot of memory, and if all that memory wasn't used it would be some orders of magnitude slower to compute. Either way, it counters custom hardware attacks, where there ...
2
votes
1answer
360 views

How to encrypt data and login with same password - revisited

I read previous posts about the topic of how to encrypt data and login with the same password/key, however the concept still seems unclear to me, especially which data it is safe to store in the ...
1
vote
1answer
91 views

Does changing the scrypt salt have security implications?

I'm using scrypt to stretch a user-supplied password for use as an AES encryption key. The data that's being encrypted with the AES encryption never changes. I'm aware that if the user changes the ...
0
votes
3answers
107 views

Are Salt strings stored by application? [duplicate]

1) As storing passwords in plain text in databases are not secure and so is not a good practice. password stored in db = "abcde" (plain text) 2) To avoid this, passwords are stored after being hashed ...
0
votes
1answer
520 views

Why is a scrypt hash different each time?

I'm trying to wrap my mind around scrypt and how it's hashing works. I've got a basic function that will create a scrypt hash, however it seems that everytime I run it, the hash is different. Does ...
1
vote
1answer
79 views

File encryption at rest, password considerations

I have at most 10,000 files that I want to store encrypted with one password. The current idea is: Have 1 master file containing (expensive) parameters for scrypt. For encryption/decryption hash a ...
6
votes
0answers
996 views

How to interpret the scrypt vs bcrypt vs pbkdf2 comparison table?

You are probably familiar with this table: The source of the table is this here This table is 10+ years old. Is this still valid with actual technology? Wikipedia says that since 2014 there is ...
0
votes
0answers
123 views

How to tune a KDF algorithm to protect a private key?

I need to protect a private key RSA-4096 with a key derived by a KDF algorithm. Instead of hiding any aspect of the algorithm I would like to tune it such that the key derivation is a proof of work ...
0
votes
1answer
157 views

Why does scrypt need HMAC? [duplicate]

I don't understand how HMAC can be used in the scrypt algorithm. For what purpose does scrypt use HMAC?
5
votes
1answer
135 views

Should I keep scrypt/bcrypt parameters secret?

The RFC does not specify, but I think if these values were available, they may help the attacker. For example, for scrypt, if the block size parameter r, the CPU/Memory cost parameter N, and the ...
0
votes
1answer
53 views

Optionally using Sha-3 before scrypt depending on password length?

First note: This is on-disk usage only, never transmitted over a server. How secure, or additionally secure, is it to sha-3 (512) a password if said password is below 128 characters, THEN proceeding ...
8
votes
1answer
447 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
2
votes
3answers
666 views

Isn't using pbkdf2 + scrypt + bcrypt best?

Since slower is better and key stretching is an awesome way to increase security over potentially low entropy passwords, doesn't it make sense to use all three? To be clear, this is about ...
2
votes
3answers
409 views

Pre-generating 'secure tokens'

In our web app we make good use of single use tokens. For example, when somebody creates any of the three "accounts", resets their password, or any other number of things that require random single-...
2
votes
1answer
61 views

Sending noise over wire, using hashes of noise to carry data

Imagine highly dystopian environment, where oppressive evil government MITMs over all connections and uses DPI to thwart any attempts to use TLS/SSL, TOR, I2P etc. To establish connection, these ...
4
votes
2answers
359 views

Password manager's hash choices (scrypt + sha256)

Background information: Master password is a stateless password manager. It (deterministically) generates a password using a hash function, depending on your master password and the site name (also ...
9
votes
4answers
492 views

Major industry password leaks using salted HMAC but without eg PBKDF2, scrypt

I'm trying to convince higher-ups on a project to use an iterative strengthening function to secure password-storage for a new system. The current proposal would store something like an HMAC of a ...
4
votes
1answer
446 views

Is the 'demo' scrypt a good choice for file encryption?

The scrypt command line utility (see http://www.tarsnap.com/scrypt.html) is actually just a demonstration of the script password hashing algorithm. However, for simple command line encryption of ...
1
vote
2answers
198 views

Double hashing using a relatively new hash and a old, tested one

Note: I am relatively new to cryptography in general, so please point out if I make any misconception here. I heard that you should always use well known crypto/hash functions, that have already been ...
6
votes
1answer
2k views

How secure is Scrypt, really?

I've been recently taking a hard look at the scrypt system for storing users' passwords. However, I'm rather worried about it's security because of things like Litecoin miners. Is scrypt secure ...
3
votes
1answer
132 views

Basic scrypt question

Suppose we throw a regular password into scrypt to generate some data. Scrypt allows us to specify how large the output data should be. My question is, to take an extreme case, if we ask for a 1 GB ...
8
votes
2answers
2k views

Why does node.js scrypt function use HMAC this way?

According to the documentation, the scrypt hash function works like so: The hash function does the following: Adds random salt. Creates a HMAC to protect against active attack. Uses the ...
3
votes
1answer
195 views

How to implement application-specific passwords using strong hashes?

I am implementing a service where application-specific passwords seem a good choice to improve security. A question on why and when they might make sense has already been discussed here Google ...
1
vote
1answer
476 views

Designing a password auth/reg system

I'm designing a user reg/auth system for a website and came up with this design for password based authentication. I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
2
votes
2answers
248 views

Combining SCRYPT + a short crc

I'm considering using SCRYPT for password storage. (I'm open to PBKDF2 as well, or bcrypt by itself). The issue is that I don't want this to become a potential point for a DDOS attack, given the ...
9
votes
1answer
655 views

Any problems with scrypt yet?

In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis". ...
2
votes
2answers
147 views

Simple PBKDF2 vs. scrypt question

scrypt was designed to use more memory. We can use its parameters to specify (approximately) how much memory we want it to require. But both scrypt and PBKDF2 allow us to specify the output data size....
0
votes
1answer
130 views

How are SCrypt's memory-hard requirements substituted with more CPU?

I've implemented scrypt with two separate APIs and in both there existed no settings providing a way to substitute CPU for memory. Both were locked one-to-one with rounds and memory. However in ...
3
votes
3answers
973 views

How does ASIC cryptocoin miners affect the security of scrypt?

Is the availability of these miners a reason to favor bcrypt (or something else) over scrypt? I mean, the goal of a password hash function is to maximize the work needed for an attacker to break a ...
3
votes
1answer
1k views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
9
votes
2answers
689 views

Has scrypt been broken, finally?

If I understand correctly, according to this: http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html, looks like the attacker can just create an optimimized version of scrypt that produce ...
1
vote
1answer
213 views

I know scrypt is newer than bcrypt, but is there any reason it would be weaker?

From what I read, scrypt is (on paper) more secure than bcrypt, but it's pretty new so it's better to let it get time-tested and scrutinized first. However, is there any good, compelling reason to ...
4
votes
4answers
16k views

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
0
votes
0answers
32 views

Length-constant password comparison in scrypt? [duplicate]

E.g.: XORing the candidate against stored then comparing against 0. Do I need to worry? (my question is much in the same style as this question: Does bcrypt compare the hashes in "length-...
17
votes
1answer
830 views

Is the Litecoin Scrypt hashing technique a threat to hashed passwords?

The Bitcoin alternative, Litecoin uses a different algorithm to protect the block chain, namely Scrypt (not Sha256). Given that GPU accelerators exists, and ASICS are due to be released, does the ...
2
votes
1answer
386 views

ASIC/FPGA hardwares to compute Scrypt hashes [closed]

this company claim Scrypt mining by ASIC (on crypto currencies who use scrypt hashing as proof of work) scrypt is made to keep ASIC/FPGA attackers away, is that claim expired?
0
votes
1answer
688 views

Comparison of bcrypt and scrypt

Is there any comparison of bcrypt versus scrypt? I am particularly interested in how bcrypt(10) bcrypt(20) or even bcrypt(30) scales in comparison to scrypt(1)?
0
votes
2answers
1k views

scrypt strength with “weak” salt

I'm working on a project where following constrains apply: There's no remote database or any other means of storing extra data like random salt When user logins in, only username and password are ...
11
votes
3answers
875 views

has scrypt withstood the test of time?

I've always heard that scrypt was better than bcrpyt... because of memory causing GPU a very difficult time to crack. However, the notion always was that scrypt hadn't been tested, it was kind of a ...
6
votes
1answer
325 views

Password strengthening for PGP

I'm wondering about some of the semantics and security implications of using something like scrypt or bcrypt to "enhance" a password protecting a PGP private key. Essentially, I'm asking about the ...
5
votes
2answers
3k views

Do SSD's offer significant performance boost for Scrypt?

Being a memory intensive hash, I was wondering if SSD's offer any appreciable performance boost for brute force attacks.
79
votes
10answers
8k views

Why improvising your own Hash function out of existing hash functions is so bad

I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
49
votes
3answers
39k views

Is bcrypt better than scrypt [duplicate]

Possible Duplicate: Do any security experts recommend bcrypt for password storage? I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based applications ...
3
votes
2answers
1k views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES encryption key from a more ...
5
votes
5answers
811 views

What about combining pkdf2 with scrypt? [duplicate]

Possible Duplicate: Would it make sense to use Bcrypt and PBKDF2 together? How does the following password hashing scheme look to you? iterations1 = scrypt iterations required to spend 50ms on ...