Overview
Scrypt fills and revisits a large memory array, making brute-force password attacks expensive on specialized parallel hardware.
CoreSource checked
Scrypt
Derives password keys with intentionally high memory use to resist hardware guessing.
Quick Facts
Compact metadata for implementation and discovery.
- Category
- Cryptography
- Difficulty
- Advanced
- Family
- Password Hashing
- Tier
- Core
- Status
- Verified
- Review
- Source Checked
- Sources
- 1
- Formulas
- 1
- Relationships
- 4
- Code example
- Ready
- Visualization
- Ready
Core Concepts
memory hardnesssaltkey stretchingsequential memory accessmisuse resistanceparameter validation
Quick facts
Complexity
Runtime and memory behavior at a glance.
Best
O(N)
Average
O(N)
Worst
O(N)
Space
O(N)
When to Use
- Use when protecting messages needs memory hardness.
- Use when the input matches the assumptions behind password Hashing.
When Not to Use
- Avoid when a well-reviewed library already provides the primitive for production use.
- Avoid when a simpler algorithm gives the required result with less setup.
What It Does
- Derives password keys with intentionally high memory use to resist hardware guessing
- Uses memory hardness and salt to guide the work.
- Produces ciphertext, digest, proof, or derived key.
Use Cases
- Protecting messages
- Authenticating data
- Deriving or managing cryptographic material
Inputs
- Secret key or public parameters
- Message or secret data
- Nonce, salt, or context where needed
Outputs
- Ciphertext, digest, proof, or derived key
Key Formulas (1)
Memory cost
memory ≈ 128 · r · N bytes
memory ~= 128 * r * N bytesEstimates the working memory controlled by scrypt parameters.
Pseudocode
- 1.Validate keys, nonces, salts, group parameters, and input ranges
- 2.Apply the primitive's block, hash, group, or reduction operation
- 3.Combine intermediate values exactly as the construction specifies
- 4.Return the protected value, proof, signature, derived key, or verification result
Canonical Example
- Input
- message = 'pay 10' with configured keys, nonces, or public parameters
- Output
- Ciphertext, digest, proof, or derived key
- Explanation
- Scrypt applies memory hardness to produce ciphertext, digest, proof, or derived key.
Implementation Notes
- Use constant-time library implementations for real systems instead of hand-written primitives.
- Keep the memory hardness step separate enough to test independently.
- Use reviewed libraries and protocol specifications for production security-sensitive code.
Common Pitfalls
- Reusing nonces, salts, pads, or domain parameters can destroy the intended security property.
- Test edge cases, not only clean examples.
- Treating educational pseudocode as production crypto can hide nonce, parameter, and side-channel requirements.
Interactive Mechanism Walkthrough
Graph Frontier & Edge RelaxationShow the major cryptographic rounds or data dependencies without exposing secrets.
Step 1 of 4: Validate keys, nonces, salts, group parameters, and input ranges
cryptography-mechanismNotes
Scrypt's memory and CPU parameters must be tuned together; weak settings lose the intended memory-hard advantage.
Sources (1)
What each reference supports for this entry.
RFC 7914
DocumentationIETF reference for the scrypt password-based key derivation function.
Open sourceExplore Next
Good next jumps from the relationship graph, ranked for useful discovery.
Relationships
View full relationship pageTags
CryptographyPassword HashingKey DerivationSecurity