Scrypt

A pure Elixir implementation of the scrypt password-based key derivation function (KDF), byte-exact against RFC 7914.

The memory-hard core (Salsa20/8, BlockMix, ROMix) is implemented in pure Elixir, building on the primitives exposed by the salsa20 library. The PBKDF2-HMAC-SHA256 layers are provided by OTP's :crypto.

Why byte-exact?

scrypt has no canonical file format — clients communicate N, r, p, salt and key length out of band. Two implementations only interoperate if they derive identical bytes from identical inputs. This library is verified against the RFC 7914 reference vectors and the test vectors carried by Go's x/crypto/scrypt and Python's cryptography, so it can be mixed freely with other conforming implementations.

Usage

iex> Scrypt.scrypt("password", "NaCl", 1024, 8, 16, 64) |> Base.encode16()
"FDBABE1C9D3472007856E7190D01E9FE7C6AD7CBC8237830E77376634B3731622EAF30D92E22A3886FF109279D9830DAC727AFB94A83EE6D8360CBDFA2CC0640"

Raises ArgumentError unless n is a power of two greater than 1, r > 0, p > 0, and 128 * r * p < 2^30.

The intermediate functions Scrypt.romix/3 and Scrypt.blockmix/2 are exposed (@doc false) so the RFC 7914 section 9/10 vectors can be tested directly.

Parameters

• n - CPU/memory cost. A power of 2 greater than 1 (e.g. 2, 1024, 16384).
• r - block size parameter.
• p - parallelization parameter.
• keylen - derived key length in bytes.

Resources scale as n * r * 128 bytes.