MAC, KDF & password hashingAcceptable
scrypt
Memory-hard password hashing and key derivation
How it works
scrypt deliberately requires a large amount of memory as well as CPU time to compute. Because memory is expensive to replicate on GPUs and custom chips, attackers cannot cheaply run millions of guesses in parallel. It was designed by Colin Percival and is specified in RFC 7914.
Sizes: Parameters N (cost), r (block size) and p (parallelism)
Status: Strong choice; Argon2id is the current first preference.
Strengths
- Memory-hard, raising the cost of hardware-accelerated cracking
- Tunable cost parameters
Weaknesses and known attacks
- Parameters are easy to get wrong
- Not FIPS-approved
- High memory settings can be used to exhaust server resources if login is not rate limited
Use it for
- Password storage
- Deriving keys from passphrases
Don't use it for
- FIPS-only systems
Exam tip
If a question asks which algorithm resists GPU cracking by using lots of memory, the answer is scrypt or Argon2.