README

Scrypt for Delphi

Scrypt is a key derivation function. It is designed to take a password (and some salt), and generate a desired number of pseudo-random bytes.

The generated bytes are usually then used as a symmetric encryption key. SCrypt is similar to PBKDF2, except that it is memory-hard, making it difficult to parallelize in hardware. It was first described by Colin Percival in 2012 for the Tarsnap online backup service.

Sample Usage

To generate 16 bytes (e.g. AES-128 key) from a password, and using default cost factors:

secretKey := TScrypt.GetBytes('correct horse battery staple', 'seasalt', 16); //returns 16 bytes (128 bits)

To specify custom Scrypt parameters:

secretKey := TScrypt.GetBytes('correct horse battery staple', 'seasalt', {N=2^}14}, {r=}8, {p=}1, 32); //returns 32 bytes (256 bits)

Password Hashing

The TScrypt class also supports being used for password hashing (i.e. storage and verification of passwords).

• To hash a password:
  pascalCopy

  hash := TScrypt.HashPassword('correct battery horse staple'); //using default cost factors

• To hash a password specifying your own cost factors:
  pascalCopy

  hash := TScrypt.HashPassword('correct battery horse staple', 14, 8, 1); //N=2^14, r=8, p=1

• To verify a password:
  pascalCopy

  isPasswordValid := TScrypt.CheckPassword('correct battery horse stapler', expectedHash, {out}passwordRehashNeeded);

By convention TScrypt outputs a password hash as string in the form:

$s1$NNrrpp$salt$hash
$s1$131003$aXzuBr2qvisBj/bl7vr2pe$ksOS0sSZD38pZ8Nr/Zucq6fZrSLrQJTwXMmpSRvK4fGmyHg/ivJnd/dTDMICZO3uVvCxL/tQqjlLCK6bfz31Ju

The parts of the string are:

Because the three scrypt parameters are stored in the returned string, scrypt password hashes are backwards and forwards compatible with changing the factors. It also makes Scrypt extraordinarily convenient, in that a random salt is automatically generated and stored for you (you don't have to worry about storing it in a database or retrieving it).

Scrypt Operation

Scrypt uses three parameters to tune CPU and memory usage:

• CostFactor: determines how many blocks will have to be allocated in memory (the memory hard factor).
  pascalCopy

  # of blocks = *"cost"* = N = 2^costFactor
  Memory required =cost*blockSize = 2^costFactor * blockSize

• BlockSizeFactor: determines the size of a block (r)
  pascalCopy

  BlockSize = blockSizeFactor * 128 bytes

• ParallelizationFactor: determines how many independant calculations have to be performed (p)

The default parameters given in the original whitepaper are:

• CostFactor (cf): 14 (N = 214 = 16,384)
• Block Size Factor (r): 1 (blockSize = 1*128 bytes)
• Parallelization Factor (p): 1

Note: Most scrypt documentation uses Cost (N), which is a large value and a power of two. We adopt the BCrypt convention of expressing a Cost Factor, which is the log_2(Cost).

Algorithm

Scrypt uses the standard PBDKF2 function to generate the desired number of bytes. The password fed to PBKDF2 is the user password. The virtue of Scrypt is its expensive generation of the salt to be fed into PBKDF2:

Created by Ian Boyd, 4/9/2015, and released into the public domain