Hashing · RFC 7914
scrypt
scrypt is a memory-hard key derivation function with tunable memory and CPU cost.
Key facts
| Standard | RFC 7914 |
|---|---|
| Parameters | N, r, p |
| Memory | Roughly 128 × N × r bytes |
| Type | Memory-hard KDF |
| Uses | Passwords, wallet keys |
| Output | Arbitrary length |
Memory as a cost
scrypt deliberately allocates a large memory buffer, which makes parallel hardware attacks expensive because each guess needs memory bandwidth as well as computation. The cost is controlled by N (CPU/memory iterations), r (block size) and p (parallelization).
It was designed for password storage and key derivation. Some cryptocurrency wallets use it to derive keys from passphrases, and it appears in older password databases. The parameters must be stored with the hash.
Choosing parameters
Start from a memory target the server can afford, such as 16–64 MB per hash, then increase N until the computation takes an acceptable time. Raising p adds parallelism without increasing memory per lane, which is less useful against GPUs than raising memory.
Argon2id is the newer memory-hard design and is generally preferred for new password storage. scrypt remains a solid choice where it is already deployed or required by a standard.
Frequently asked questions
What do N, r and p mean?
N is the iteration count, r the block size and p the parallelization factor. Memory use grows with N and r.
Is scrypt better than bcrypt?
It is memory-hard, which raises the cost of parallel attacks. Argon2id is the more recent recommendation.