How to Use scrypt for Key Derivation

Problem

You want a key derivation function that is resistant to specialized hardware attacks, not just CPU brute force.

Prerequisites

• Understanding of PBKDF2 and its limitations
• Knowledge of memory-hard functions

Steps

1. 1. Set the cost parameters

   scrypt takes three parameters: N (CPU/memory cost, power of 2), r (block size), and p (parallelism). A common setting is N=16384, r=8, p=1, which uses about 16 MB of memory. Higher N increases both time and memory quadratically.

   Input

   N=16384, r=8, p=1

   Output

   ~16MB memory, ~100ms

2. 2. Generate a salt and derive the key

   Generate a random salt of at least 16 bytes. Run scrypt with the password, salt, N, r, p, and desired key length. The memory-hardness forces attackers to use significant RAM per guess, making GPU farms uneconomical.

   Input

   password + salt + params

   Output

   32-byte derived key

3. 3. Store parameters for verification

   Store N, r, p, and the salt alongside the derived key. These parameters are needed to re-derive the key for verification. They are not secret. Increase N over time as hardware improves.

   Input

   stored: N, r, p, salt, hash

   Output

   can verify later

Expected result

A memory-hard derived key that resists both CPU and memory-optimized brute force attacks.

Common errors

N is not a power of 2

scrypt requires N to be a power of 2. Use 16384, 32768, 65536, etc.

Memory usage is too high for the server

Lower N or r. Memory is approximately N × r × 128 bytes. Tune to fit your server's constraints.

Troubleshooting

• If derivation throws a memory error, reduce N or r.
• If performance is acceptable, consider increasing N for better security over time.

Security limits

• scrypt's memory-hardness is its key advantage over PBKDF2. It forces attackers to spend both CPU and memory.
• All derivation is local.