Questions tagged [scrypt]
Scrypt is a recent key derivation function designed for password storage. It aims to improve on earlier similar functions such as PBKDF2 and bcrypt by requiring significant amounts of memory in addition to computation time.
61 questions
0
votes
1
answer
652
views
Hashing email addresses using scrypt
I want to hash email addresses so that they are anonymous but still unique in my database. I was thinking of using scrypt for this and creating the salt as a sha256 of some secret stored on the server ...
- 195
1
vote
1
answer
312
views
SCrypt's goal and the role its salt plays
Am I right in stating that SCrypt as an algorithm is useful where many passwords are stored in a database, but not against one specific encryption key derived from one password of one user?
For ...
- 11
2
votes
1
answer
261
views
Is there any benefit to encrypting a derived key?
I'm working on updating the encryption method of a class at work. The encrypt and decrypt methods take the text to encrypt/decrypt and a string which used to be used as a salt (this string is ...
- 121
4
votes
1
answer
378
views
Why isn't it more popular to increase the p (parallelization) parameter of scrypt?
First of all, the understanding I have of the p parameter in scrypt is that it multiplies the amount of work to do, but in such a way that the additional workloads are independent from each other, and ...
- 141
7
votes
1
answer
456
views
Detect duplicates without exposing underlying data
We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
- 71
3
votes
1
answer
596
views
Has scrypt gone through enough testing to be considered secure?
Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as:
"Scrypt has mostly ...
1
vote
0
answers
1k
views
Is it possible decrypt Android 8 encryption, if the device encryption key is gone (but with a known PIN and KEK)?
main question is in the title. Some clarification though:
When you factory reset your encrypted phone, the old device encryption key (DEK a) gets deleted and a new encryption key (DEK b) is being ...
- 41
108
votes
1
answer
55k
views
In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?
There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
- 3,865
1
vote
1
answer
217
views
Concerns regarding a password manager web app [closed]
I've written a password manager in JavaScript. It works in a browser.
Try it out
Are there any fundamental issues with the concept of a web based password manager?
Should I be concerned if hashes ...
- 173
6
votes
3
answers
19k
views
How Facebook hashes passwords
I found this presentation how Facebook stores customer passwords and how they do authentication.
This slide shows how they hash passwords:
Is it a good idea to do such operations with a raw password?...
- 247
3
votes
0
answers
304
views
Salt in argon2d as proof-of-work algorithm
I want to use argon2d as a proof-of-work algorithm. But as I know I can't use the algorithm without salt? Should I use a static salt for every task or generate new? Is it possible to increase ...
- 131
1
vote
3
answers
191
views
Password hashes with large internal state
scrypt was designed to use a lot of memory, and if all that memory wasn't used it would be some orders of magnitude slower to compute. Either way, it counters custom hardware attacks, where there ...
- 373
2
votes
1
answer
822
views
How to encrypt data and login with same password - revisited
I read previous posts about the topic of how to encrypt data and login with the same password/key, however the concept still seems unclear to me, especially which data it is safe to store in the ...
- 123
1
vote
1
answer
192
views
Does changing the scrypt salt have security implications?
I'm using scrypt to stretch a user-supplied password for use as an AES encryption key. The data that's being encrypted with the AES encryption never changes.
I'm aware that if the user changes the ...
- 113
2
votes
3
answers
288
views
Are Salt strings stored by application? [duplicate]
1) As storing passwords in plain text in databases are not secure and so is not a good practice.
password stored in db = "abcde" (plain text)
2) To avoid this, passwords are stored after being hashed ...
- 151
0
votes
1
answer
987
views
Why is a scrypt hash different each time?
I'm trying to wrap my mind around scrypt and how it's hashing works. I've got a basic function that will create a scrypt hash, however it seems that everytime I run it, the hash is different. Does ...
- 285
1
vote
1
answer
187
views
File encryption at rest, password considerations
I have at most 10,000 files that I want to store encrypted with one
password.
The current idea is:
Have 1 master file containing (expensive) parameters for scrypt.
For encryption/decryption hash a ...
12
votes
1
answer
2k
views
How to interpret the scrypt vs bcrypt vs pbkdf2 comparison table?
You are probably familiar with this table:
The source of the table is this here
This table is 10+ years old. Is this still valid with current technology?
Wikipedia says that since 2014 there is ...
- 287
0
votes
0
answers
216
views
How to tune a KDF algorithm to protect a private key?
I need to protect a private key RSA-4096 with a key derived by a KDF algorithm.
Instead of hiding any aspect of the algorithm I would like to tune it such that the key derivation is a proof of work ...
- 287
0
votes
1
answer
406
views
Why does scrypt need HMAC? [duplicate]
I don't understand how HMAC can be used in the scrypt algorithm. For what purpose does scrypt use HMAC?
4
votes
1
answer
374
views
Should I keep scrypt/bcrypt parameters secret?
The RFC does not specify, but I think if these values were available, they may help the attacker.
For example, for scrypt, if the block size parameter r, the CPU/Memory cost parameter N, and the ...
0
votes
1
answer
249
views
Optionally using Sha-3 before scrypt depending on password length?
First note: This is on-disk usage only, never transmitted over a server.
How secure, or additionally secure, is it to sha-3 (512) a password if said password is below 128 characters, THEN proceeding ...
8
votes
1
answer
764
views
What are the recommended scrypt cost factors for 2016?
I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
- 480
5
votes
3
answers
1k
views
Isn't using pbkdf2 + scrypt + bcrypt best?
Since slower is better and key stretching is an awesome way to increase security over potentially low entropy passwords, doesn't it make sense to use all three?
To be clear, this is about ...
- 384
2
votes
3
answers
717
views
Pre-generating 'secure tokens'
In our web app we make good use of single use tokens. For example, when somebody creates any of the three "accounts", resets their password, or any other number of things that require random single-...
- 2,371
2
votes
1
answer
123
views
Sending noise over wire, using hashes of noise to carry data
Imagine highly dystopian environment, where oppressive evil government MITMs over all connections and uses DPI to thwart any attempts to use TLS/SSL, TOR, I2P etc. To establish connection, these ...
- 149
4
votes
2
answers
1k
views
Password manager's hash choices (scrypt + sha256)
Background information:
Master password is a stateless password manager. It (deterministically) generates a password using a hash function, depending on your master password and the site name (also ...
- 143
9
votes
4
answers
590
views
Major industry password leaks using salted HMAC but without eg PBKDF2, scrypt
I'm trying to convince higher-ups on a project to use an iterative strengthening function to secure password-storage for a new system. The current proposal would store something like an HMAC of a ...
- 203
6
votes
1
answer
902
views
Is the 'demo' scrypt a good choice for file encryption?
The scrypt command line utility (see http://www.tarsnap.com/scrypt.html) is actually just a demonstration of the script password hashing algorithm.
However, for simple command line encryption of ...
- 351
1
vote
2
answers
340
views
Double hashing using a relatively new hash and a old, tested one
Note: I am relatively new to cryptography in general, so please point out if I make any
misconception here.
I heard that you should always use well known crypto/hash functions, that have already been ...
- 111
7
votes
1
answer
4k
views
How secure is Scrypt, really?
I've been recently taking a hard look at the scrypt system for storing users' passwords. However, I'm rather worried about it's security because of things like Litecoin miners.
Is scrypt secure ...
- 382
3
votes
1
answer
224
views
Basic scrypt question
Suppose we throw a regular password into scrypt to generate some data. Scrypt allows us to specify how large the output data should be.
My question is, to take an extreme case, if we ask for a 1 GB ...
- 319
8
votes
2
answers
3k
views
Why does node.js scrypt function use HMAC this way?
According to the documentation, the scrypt hash function works like so:
The hash function does the following:
Adds random salt.
Creates a HMAC to protect against active attack.
Uses the ...
- 235
3
votes
1
answer
276
views
How to implement application-specific passwords using strong hashes?
I am implementing a service where application-specific passwords seem a good choice to improve security. A question on why and when they might make sense has already been discussed here Google ...
- 31
1
vote
1
answer
867
views
Designing a password auth/reg system
I'm designing a user reg/auth system for a website and came up with this design for password based authentication.
I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
- 111
2
votes
2
answers
345
views
Combining SCRYPT + a short crc
I'm considering using SCRYPT for password storage. (I'm open to PBKDF2 as well, or bcrypt by itself).
The issue is that I don't want this to become a potential point for a DDOS attack, given the ...
- 123
9
votes
1
answer
808
views
Any problems with scrypt yet?
In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis".
...
- 5,444
2
votes
2
answers
226
views
Simple PBKDF2 vs. scrypt question
scrypt was designed to use more memory. We can use its parameters to specify (approximately) how much memory we want it to require.
But both scrypt and PBKDF2 allow us to specify the output data size....
- 23
0
votes
1
answer
216
views
How are SCrypt's memory-hard requirements substituted with more CPU?
I've implemented scrypt with two separate APIs and in both there existed no settings providing a way to substitute CPU for memory. Both were locked one-to-one with rounds and memory.
However in ...
- 2,007
5
votes
3
answers
2k
views
How does ASIC cryptocoin miners affect the security of scrypt?
Is the availability of these miners a reason to favor bcrypt (or something else) over scrypt?
I mean, the goal of a password hash function is to maximize the work needed for an attacker to break a ...
- 1,603
3
votes
1
answer
1k
views
Database row level encryption scheme
I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
- 31
10
votes
2
answers
1k
views
Has scrypt been broken, finally?
If I understand correctly, according to this: http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html, looks like the attacker can just create an optimimized version of scrypt that produce ...
- 685
1
vote
1
answer
299
views
I know scrypt is newer than bcrypt, but is there any reason it would be weaker?
From what I read, scrypt is (on paper) more secure than bcrypt, but it's pretty new so it's better to let it get time-tested and scrutinized first. However, is there any good, compelling reason to ...
- 733
7
votes
4
answers
31k
views
Is salted MD5 or salted SHA considered secure?
Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
- 91
0
votes
0
answers
35
views
Length-constant password comparison in scrypt? [duplicate]
E.g.: XORing the candidate against stored then comparing against 0.
Do I need to worry?
(my question is much in the same style as this question: Does bcrypt compare the hashes in "length-...
- 193
17
votes
1
answer
940
views
Is the Litecoin Scrypt hashing technique a threat to hashed passwords?
The Bitcoin alternative, Litecoin uses a different algorithm to protect the block chain, namely Scrypt (not Sha256).
Given that GPU accelerators exists, and ASICS are due to be released, does the ...
- 51.1k
2
votes
1
answer
541
views
ASIC/FPGA hardwares to compute Scrypt hashes [closed]
this company claim Scrypt mining by ASIC (on crypto currencies who use scrypt hashing as proof of work)
scrypt is made to keep ASIC/FPGA attackers away, is that claim expired?
- 21
0
votes
1
answer
1k
views
Comparison of bcrypt and scrypt
Is there any comparison of bcrypt versus scrypt? I am particularly interested in how bcrypt(10) bcrypt(20) or even bcrypt(30) scales in comparison to scrypt(1)?
- 101
0
votes
2
answers
2k
views
scrypt strength with "weak" salt
I'm working on a project where following constrains apply:
There's no remote database or any other means of storing extra data like random salt
When user logins in, only username and password are ...
- 3
13
votes
3
answers
1k
views
has scrypt withstood the test of time?
I've always heard that scrypt was better than bcrpyt... because of memory causing GPU a very difficult time to crack. However, the notion always was that scrypt hadn't been tested, it was kind of a ...
- 305