Scrypt

이 알고리즘은 대량의 메모리를 필요로 하여 대규모 맞춤형 하드웨어 공격을 수행하는 데 비용이 많이 들도록 특별히 설계되었다. 2016년에 scrypt 알고리즘은 IETF에서 RFC 7914로 게시되었다. scrypt의 단순화된 버전은 여러 암호화폐에서 작업 증명 체계로 사용되며 처음에는 테네브릭스(Tenebrix)의 아트포즈(ArtForz)라는 익명 프로그래머에 의해 구현되었고 이후 페어브릭스(Fairbrix)와 라이트코인이 출시되기에 이른다.

Function scrypt    Inputs: This algorithm includes the following parameters:       Passphrase:                Bytes    string of characters to be hashed       Salt:                      Bytes    string of random characters that modifies the hash to protect against Rainbow table attacks       CostFactor (N):            Integer  CPU/memory cost parameter – Must be a power of 2 (e.g. 1024)       BlockSizeFactor (r):       Integer  blocksize parameter, which fine-tunes sequential memory read size and performance. (8 is commonly used)       ParallelizationFactor (p): Integer  Parallelization parameter. (1 .. 232-1 * hLen/MFlen)       DesiredKeyLen (dkLen):     Integer  Desired key length in bytes (Intended output length in octets of the derived key; a positive integer satisfying dkLen ≤ (232− 1) * hLen.)       hLen:                      Integer  The length in octets of the hash function (32 for SHA256).       MFlen:                     Integer  The length in octets of the output of the mixing function (SMix below). Defined as r * 128 in RFC7914.    Output:       DerivedKey:                Bytes    array of bytes, DesiredKeyLen long     Step 1. Generate expensive salt    blockSize ← 128*BlockSizeFactor  // Length (in bytes) of the SMix mixing function output (e.g. 128*8 = 1024 bytes)     Use PBKDF2 to generate initial 128*BlockSizeFactor*p bytes of data (e.g. 128*8*3 = 3072 bytes)    Treat the result as an array of p elements, each entry being blocksize bytes (e.g. 3 elements, each 1024 bytes)    [B0...Bp−1] ← PBKDF2HMAC-SHA256(Passphrase, Salt, 1, blockSize*ParallelizationFactor)     Mix each block in B Costfactor times using ROMix function (each block can be mixed in parallel)    for i ← 0 to p-1 do       Bi ← ROMix(Bi, CostFactor)     All the elements of B is our new "expensive" salt    expensiveSalt ← B0∥B1∥B2∥ ... ∥Bp-1  // where ∥ is concatenation      Step 2. Use PBKDF2 to generate the desired number of bytes, but using the expensive salt we just generated    return PBKDF2HMAC-SHA256(Passphrase, expensiveSalt, 1, DesiredKeyLen); 

• Argon2
• Bcrypt
• 키 유도 함수
• PBKDF2

• The scrypt page on the Tarsnap website.
• The original scrypt paper.
• (영어) scrypt - 깃허브