Scrypt

Scrypt (pronounced "ess-crypt") is a password-based key derivation function: an algorithm that turns a password into a cryptographic key in a way that is deliberately slow and memory-hungry. It was designed by Colin Percival in 2009 for Tarsnap, his online backup service, and was published as an IETF informational standard, RFC 7914, in August 2016. Its purpose is to make large-scale guessing of passwords expensive, because an attacker must pay not only for computation but also for memory.

Scrypt has two quite different audiences. Security engineers use it, alongside bcrypt and Argon2, to store passwords and derive encryption keys. In crypto, it is best known as the proof-of-work (PoW) function of Litecoin (LTC) and Dogecoin (DOGE), chosen as an alternative to Bitcoin's SHA256. The two uses rely on the same algorithm but very different settings.

Imagine a lock that only opens after you have filled a large notebook with notes, in order, and then flicked back to random pages to check them. A burglar trying a million keys would need a million notebooks, or would have to rewrite the same notebook again and again. Either way, guessing becomes slow and costly.

Ordinary hash functions are more like a short sum that fits on a sticky note. They are quick for everyone, including attackers with specialised chips. Scrypt forces each guess to use a sizeable chunk of memory, and memory is harder to cram onto a cheap chip than arithmetic, so the attacker's advantage shrinks.

Scrypt builds on PBKDF2 with HMAC-SHA256. It first stretches the password and a salt into a block of data, then runs a routine called ROMix that fills a large table with successive outputs of a fast mixing function (Salsa20/8) and then reads that table back in an order that depends on the data itself. Because the read order cannot be predicted, an attacker cannot skip storing the table without recomputing it many times over. A final PBKDF2 pass produces the output key.

Three parameters control the cost:

• $N$ is the CPU and memory cost: the number of table entries, which must be a power of two.
• $r$ is the block size, which sets how large each entry is and tunes memory bandwidth.
• $p$ is the parallelisation factor: how many independent mixing runs are performed.

The memory needed for one run is approximately:

where $M$ is memory in bytes. Litecoin uses $N = 1024$, $r = 1$ and $p = 1$, so each hash needs about $128 \times 1024 \times 1 = 131{,}072$ bytes, or 128 KiB. Password storage settings are far heavier; with $N = 2^{20}$ and $r = 8$, each derivation needs about 1 GiB of memory.

Scrypt entered crypto in 2011 through Tenebrix, a short-lived coin, and then Litecoin, launched by Charlie Lee in October 2011. The goal was to keep mining open to ordinary computers and to resist the specialised hardware that was starting to dominate Bitcoin (BTC). Dogecoin adopted scrypt at its launch in December 2013 and, from 2014, allowed merged mining with Litecoin, so a single scrypt miner can secure both chains at once.

The ASIC resistance did not last. The 128 KiB setting chosen for mining was small enough to fit on a chip, and scrypt ASICs reached the market in 2014. Since then, Litecoin and Dogecoin mining has been dominated by dedicated scrypt machines rather than the graphics processing units (GPUs) that ran it at first. Later projects that wanted to stay ASIC-resistant chose heavier or changing algorithms, such as Ethereum's former Ethash or Monero's RandomX.

In mining, scrypt simply replaces SHA256 inside the usual loop: miners vary the nonce in a block header, compute the scrypt output and check it against the target set by mining difficulty. Scrypt hashrate is quoted in much smaller units than Bitcoin's, typically megahashes or gigahashes per second per machine, because each scrypt hash is far more expensive to compute.

In security work, scrypt is one of the functions recommended for storing passwords, so that a stolen database in a data breach cannot easily be reversed. OWASP's password storage guidance lists scrypt as an acceptable choice where Argon2id is not available. Scrypt is also used to derive keys that protect private keys in some wallet file formats; Ethereum's standard keystore format, for example, supports scrypt for encrypting a stored key.

Scrypt's strength depends entirely on its settings. Light parameters, as used in mining, give little protection against specialised hardware, and heavy parameters can strain servers that must check many logins at once. Its design also lets an implementer trade memory for extra computation, which weakens the memory-hardness guarantee somewhat; Argon2, which won the Password Hashing Competition in 2015, was designed partly to address this. For password storage, scrypt is now usually a second choice after Argon2id, while in crypto it survives mainly as the legacy algorithm of the Litecoin and Dogecoin family.

• RFC 7914: The scrypt Password-Based Key Derivation Function
• Tarsnap: The scrypt key derivation function
• Litecoin