DataTerminology.comNEW
A memory-hard password-based key derivation function designed to resist GPU and ASIC acceleration by requiring substantial memory.
DESCRIPTION
scrypt is a password-based KDF that increases attack cost by requiring significant memory and computation, limiting gains from parallel hardware. It takes parameters controlling memory usage (N, r, p) and uses salts to ensure uniqueness. scrypt is standardized in RFC 7914 and widely supported in cryptographic libraries. For new deployments, Argon2 is often preferred due to formal analysis and PHC recognition, but scrypt remains a strong, practical choice.
ALTERNATIVE DEFINITIONS
IETF RFC 7914
This document specifies the scrypt password-based key derivation function.
Formal specification statement of the function.
Wikipedia
scrypt is a password-based key derivation function created by Colin Percival that was originally used by the Tarsnap online backup service.
Notes origin and creator, adding historical context.
RELATED TERMS
Key Derivation Function Memory-Hard Function Salt Password Hashing Parallelism Work Factor GPU Resistance
COMPETING TERMS
Password-Based Key Derivation Function 2 Argon2 bcrypt
KNOWLEDGE AREAS
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Software Developer DevOps Engineer
EXTERNAL SOURCES
- Wikipedia - Scrypt
- IETF - Official scrypt specification and parameters.
- OWASP - Guidance including scrypt parameterization.
- Tarsnap - Background and design rationale from creator.
TOP QUESTIONS
Why choose scrypt for password storage?
Its memory-hard design increases the cost of GPU/ASIC attacks compared to compute-bound KDFs like PBKDF2.
Category: Benefits
How do scrypt parameters affect security?
N, r, and p control memory and CPU cost; higher values increase resistance but raise verification latency and resource usage.
Category: Requirements
How does scrypt compare to Argon2?
Argon2 (PHC winner) offers modern variants and analysis; scrypt remains strong and widely available but is older.
Category: Distinction
Is scrypt suitable for key derivation beyond passwords?
Yes, but ensure parameters and contexts are appropriate; for high-entropy inputs, HKDF may be more suitable.
Category: UseCases
What mistakes occur with scrypt?
Selecting too-low parameters, not using unique salts, or ignoring memory constraints of target platforms.
Category: Mistakes
Does scrypt require salts?
Yes. Unique, random salts remain essential to prevent precomputation and ensure uniqueness.
Category: Concepts
Can scrypt be hardware-accelerated?
Some acceleration exists, but memory hardness limits the efficiency of specialized hardware compared to compute-bound KDFs.
Category: Risks
How to migrate from PBKDF2 to scrypt?
Use progressive rehashing upon login or double-wrap credentials, storing metadata to indicate the algorithm used.
Category: Management
Where to start learning scrypt?
Read RFC 7914, the Tarsnap design notes, and OWASP guidance on secure parameter choices.
Category: GettingStarted