Should the scrypt parameters be updated?

[Zenithar]

Hi,

Should we update the scrypt cost parameters (2^15, 8, 1) to be aligned with the requirement of being able to derive a key in approximatively 100ms (http://www.tarsnap.com/scrypt/scrypt-slides.pdf - Slide 17)?

Based in Filippo Valsorda blog post about scrypt - https://words.filippo.io/the-scrypt-parameters/ - I reused its benchmark on my current laptop (M1 10-Core).

func main() {
	for n := uint8(14); n < 22; n++ {
		b := testing.Benchmark(func(b *testing.B) {
			for i := 0; i < b.N; i++ {
				scrypt.Key([]byte("password"), []byte("salt"), 1<<n, 8, 1, 32)
			}
		})
		t := b.T / time.Duration(b.N)
		fmt.Printf("N = 2^%d\t%dms\n", n, t/time.Millisecond)
	}
}

And the results are :

N = 2^14	25ms
N = 2^15	52ms (current settings)
N = 2^16	106ms (Colin Percival, aka the creator, recommendation)
N = 2^17	213ms (OWASP recommendation)
N = 2^18	432ms
N = 2^19	889ms
N = 2^20	1740ms
N = 2^21	3633ms

In conclusion, from the benchmark, on my machine, the appropriate parameter should be 2^16. But the OWASP Password storage recommends 2^17.

I also noticed that this code is directly referenced by cosign to store the private key using this crypto system.https://github.com/sigstore/cosign/blob/main/pkg/cosign/keys.go#L154. Actually, I don't see any threat unless the ability to speedup the brute force attacks of this derivation.

What do you think?

[trishankatdatadog]

Thanks for filing this issue, and I don't see any reason why we shouldn't increase security! However, as we discussed offline, how would this affect backwards-compatibility?

[Zenithar]

Something like that could help to do progressive enhancements - Zenithar@658ca7b

[trishankatdatadog]

That makes sense to me, thanks. We can make this backwards-compatible by making the level legacy by default.

@rdimitrov Do you think this issue should go into 0.7?

[Zenithar]

Legacy level by default? I was more targeting Standard by default so that already encrypted envelope will be normally processed for backward compatibility, but new encryption request will use the Standard level.

WDYT?

[trishankatdatadog]

Legacy level by default? I was more targeting Standard by default so that already encrypted envelope will be normally processed for backward compatibility, but new encryption request will use the Standard level.

Oh, I see, I mistakenly thought Legacy is what Standard actually means. NVM, yes, you're right.