scrypt

scrypt.scrypt derives a key of exactly dk_len bytes from a password and salt. r, p and dk_len must be positive; n must be a nonzero power of two.

Buffer sizes are computed in u64 and checked before allocation or conversion to int. The derived key, parallel buffer, scratch buffer and work buffer must each fit V array lengths, including SHA-256 block rounding in PBKDF2. Oversized parameters return an error instead of wrapping a buffer length. These implementation limits are stricter than the RFC maximum exposed by max_buffer_length.

fn scrypt(password []u8, salt []u8, n u64, r u32, p u32, dk_len u64) ![]u8

scrypt performs password based key derivation using the scrypt algorithm.

The input parameters are:

password - a slice of bytes which is the password being used to derive the key. Don't leak this value to anybody. salt - a slice of bytes used to make it harder to crack the key. n - CPU/Memory cost parameter, must be larger than 0, a power of 2, and less than 2^(128 * r / 8). r - block size parameter. p - parallelization parameter, a positive integer less than or equal to ((2^32-1) * hLen) / MFLen where hLen is 32 and MFlen is 128 * r. dk_len - intended output length in octets of the derived key; a positive integer less than or equal to (2^32 - 1) * hLen where hLen is 32.

The output and working buffers must also fit V array lengths (signed 32-bit int), including PBKDF2 SHA-256 block rounding. Zero r, p or dk_len returns an error.

Reasonable values for n, r, and p are n = 1024, r = 8, p = 16.