Wie in Verwenden scrypt für Schlüssel Derivation

问题

You wollen ein Schlüssel derivation Funktion das ist resistant in specialized hardware attacks, nicht gerade CPU brute force.

Voraussetzungen

• Understanding of PBKDF2 and its limitations
• Knowledge of memory-hard functions

Schritte

1. 1. Set the cost parameters

   scrypt takes three parameters: N (CPU/memory cost, power of 2), r (block size), and p (parallelism). A common setting is N=16384, r=8, p=1, which uses about 16 MB of memory. Higher N increases both time and memory quadratically.

   Eingabe

   N=16384, r=8, p=1

   输出

   ~16MB memory, ~100ms

2. 2. Generate a salt and derive the key

   Generate a random salt of at least 16 bytes. Run scrypt with the password, salt, N, r, p, and desired key length. The memory-hardness forces attackers to use significant RAM per guess, making GPU farms uneconomical.

   Eingabe

   password + salt + params

   输出

   32-byte derived key

3. 3. Store parameters for verification

   Store N, r, p, and the salt alongside the derived key. These parameters are needed to re-derive the key for verification. They are not secret. Increase N over time as hardware improves.

   Eingabe

   stored: N, r, p, salt, hash

   输出

   can verify later

Erwartetes Ergebnis

Ein memory-hard derived Schlüssel das resists both CPU und memory-optimized brute force attacks.

Häufige Fehler

N is not a power of 2

scrypt requires N to be a power of 2. Use 16384, 32768, 65536, etc.

Memory usage is too high for the server

Lower N or r. Memory is approximately N × r × 128 bytes. Tune to fit your server's constraints.

Troubleshooting指引

• If derivation throws a memory error, reduce N or r.
• If performance is acceptable, consider increasing N for better security over time.

Sicherheitsgrenzen

• scrypt's memory-hardness is its key advantage over PBKDF2. It forces attackers to spend both CPU and memory.
• All derivation is local.