如何Use scrypt 为关键 Derivation
Derive 关键从 passwords using scrypt, 内存-困难 KDF 该 resists GPU 和 ASIC attacks.
问题
你 want 键 derivation 函数该 是 resistant 到 specialized hardware attacks, 不仅 CPU brute force.
前置条件
- Understanding 的 PBKDF2 和其 limitations
- Knowledge 的内存-困难函数
步骤
-
1. Set the cost parameters
scrypt takes three parameters: N (CPU/memory cost, power of 2), r (block size), and p (parallelism). A common setting is N=16384, r=8, p=1, which uses about 16 MB of memory. Higher N increases both time and memory quadratically.
输入N=16384, r=8, p=1输出~16MB memory, ~100ms -
2. Generate a salt and derive the key
Generate a random salt of at least 16 bytes. Run scrypt with the password, salt, N, r, p, and desired key length. The memory-hardness forces attackers to use significant RAM per guess, making GPU farms uneconomical.
输入password + salt + params输出32-byte derived key -
3. Store parameters for verification
Store N, r, p, and the salt alongside the derived key. These parameters are needed to re-derive the key for verification. They are not secret. Increase N over time as hardware improves.
输入stored: N, r, p, salt, hash输出can verify later
预期结果
内存-困难 derived 键该 resists 两者 CPU 和内存-optimized brute force attacks.
常见错误
- N is not a power of 2
- scrypt requires N to be a power of 2. Use 16384, 32768, 65536, etc.
- Memory usage is too high for the server
- Lower N or r. Memory is approximately N × r × 128 bytes. Tune to fit your server's constraints.
排障指引
- If derivation throws a memory error, reduce N or r.
- If performance is acceptable, consider increasing N for better security over time.
安全限制
- scrypt's memory-hardness is its key advantage over PBKDF2. It forces attackers to spend both CPU and memory.
- All derivation is local.