鍵導出に scrypt を使う方法
メモリハードな KDF である scrypt を使ってパスワードから鍵を導出します。GPU や ASIC 攻撃への耐性があります。
问题
CPU の総当たり攻撃だけでなく、専用ハードウェア攻撃にも耐性のある鍵導出関数が必要です。
前提条件
- PBKDF2 とその限界の理解
- メモリハード関数に関する知識
ステップ
-
1. Set the cost parameters
scrypt takes three parameters: N (CPU/memory cost, power of 2), r (block size), and p (parallelism). A common setting is N=16384, r=8, p=1, which uses about 16 MB of memory. Higher N increases both time and memory quadratically.
入力N=16384, r=8, p=1输出~16MB memory, ~100ms -
2. Generate a salt and derive the key
Generate a random salt of at least 16 bytes. Run scrypt with the password, salt, N, r, p, and desired key length. The memory-hardness forces attackers to use significant RAM per guess, making GPU farms uneconomical.
入力password + salt + params输出32-byte derived key -
3. Store parameters for verification
Store N, r, p, and the salt alongside the derived key. These parameters are needed to re-derive the key for verification. They are not secret. Increase N over time as hardware improves.
入力stored: N, r, p, salt, hash输出can verify later
期待される結果
CPU 最適化とメモリ最適化の両方の総当たり攻撃に耐性を持つ、メモリハードな導出鍵。
よくあるエラー
- N is not a power of 2
- scrypt requires N to be a power of 2. Use 16384, 32768, 65536, etc.
- Memory usage is too high for the server
- Lower N or r. Memory is approximately N × r × 128 bytes. Tune to fit your server's constraints.
トラブルシューティング指引
- If derivation throws a memory error, reduce N or r.
- If performance is acceptable, consider increasing N for better security over time.
セキュリティ上の制限
- scrypt's memory-hardness is its key advantage over PBKDF2. It forces attackers to spend both CPU and memory.
- All derivation is local.