Cómo a Usar scrypt para Clave Derivation

问题

You querer un clave derivation función ese es resistant a specialized hardware attacks, no solo CPU brute force.

Requisitos previos

• Understanding of PBKDF2 and its limitations
• Knowledge of memory-hard functions

Pasos

1. 1. Set the cost parameters

   scrypt takes three parameters: N (CPU/memory cost, power of 2), r (block size), and p (parallelism). A common setting is N=16384, r=8, p=1, which uses about 16 MB of memory. Higher N increases both time and memory quadratically.

   entrada

   N=16384, r=8, p=1

   输出

   ~16MB memory, ~100ms

2. 2. Generate a salt and derive the key

   Generate a random salt of at least 16 bytes. Run scrypt with the password, salt, N, r, p, and desired key length. The memory-hardness forces attackers to use significant RAM per guess, making GPU farms uneconomical.

   entrada

   password + salt + params

   输出

   32-byte derived key

3. 3. Store parameters for verification

   Store N, r, p, and the salt alongside the derived key. These parameters are needed to re-derive the key for verification. They are not secret. Increase N over time as hardware improves.

   entrada

   stored: N, r, p, salt, hash

   输出

   can verify later

Resultado esperado

Un memory-hard derived clave ese resists both CPU y memory-optimized brute force attacks.

Errores comunes

N is not a power of 2

scrypt requires N to be a power of 2. Use 16384, 32768, 65536, etc.

Memory usage is too high for the server

Lower N or r. Memory is approximately N × r × 128 bytes. Tune to fit your server's constraints.

Solución de problemas指引

• If derivation throws a memory error, reduce N or r.
• If performance is acceptable, consider increasing N for better security over time.

Límites de seguridad

• scrypt's memory-hardness is its key advantage over PBKDF2. It forces attackers to spend both CPU and memory.
• All derivation is local.