{{위키데이터 속성 추적}}
{{소문자}}
'''scrypt'''("ess crypt"로 발음)는 [[암호학]] 분야에서 원래 [[Tarsnap]] 온라인 백업 서비스를 위해 콜린 퍼시벌(Colin Percival)이 2009년 3월에 만든 비밀번호 기반 [[키 유도 함수]]이다. 이 알고리즘은 대량의 메모리를 필요로 하여 대규모 맞춤형 하드웨어 공격을 수행하는 데 비용이 많이 들도록 특별히 설계되었다. 2016년에 scrypt 알고리즘은 [[국제 인터넷 표준화 기구|IETF]]에서 RFC 7914로 게시되었다. scrypt의 단순화된 버전은 여러 [[암호화폐]]에서 작업 증명 체계로 사용되며 처음에는 테네브릭스(Tenebrix)의 아트포즈(ArtForz)라는 익명 프로그래머에 의해 구현되었고 이후 페어브릭스(Fairbrix)와 [[라이트코인]]이 출시되기에 이른다.

== 알고리즘 ==
 <span style="color:blue;">'''Function'''</span> scrypt
    <span style="color:blue;">'''Inputs:'''</span> <span style="color:green;">''This algorithm includes the following parameters:''</span>
       Passphrase:                Bytes    <span style="color:green;">string of characters to be hashed</span>
       [[Salt (cryptography)|Salt]]:                      Bytes    <span style="color:green;">string of random characters that modifies the hash to protect against [[Rainbow table]] attacks</span>
       CostFactor (N):            Integer  <span style="color:green;">CPU/memory cost parameter – Must be a power of 2 (e.g. 1024)</span>
       BlockSizeFactor (r):       Integer  <span style="color:green;">blocksize parameter, which fine-tunes sequential memory read size and performance. (8 is commonly used)</span>
       ParallelizationFactor (p): Integer  <span style="color:green;">''Parallelization parameter''. (1 .. 2<sup>32</sup>-1 * hLen/MFlen)</span>
       DesiredKeyLen (dkLen):     Integer  <span style="color:green;">Desired key length in bytes (Intended output length in octets of the derived key; a positive integer satisfying dkLen ≤ (2<sup>32</sup>− 1) * hLen.)</span>
       hLen:                      Integer  <span style="color:green;">The length in octets of the hash function (32 for SHA256).</span>
       MFlen:                     Integer  <span style="color:green;">The length in octets of the output of the mixing function (''SMix'' below). Defined as r * 128 in RFC7914.</span>
    <span style="color:blue;">'''Output:'''</span>
       DerivedKey:                Bytes    <span style="color:green;">array of bytes, DesiredKeyLen long</span>
 
    <span style="color:green;">''Step 1. Generate expensive salt''</span>
    blockSize ← 128*BlockSizeFactor  <span style="color:green;">''// Length (in bytes) of the SMix mixing function output (e.g. 128*8 = 1024 bytes)''</span>
 
    <span style="color:green;">Use PBKDF2 to generate initial 128*BlockSizeFactor*p bytes of data (e.g. 128*8*3 = 3072 bytes)</span>
    <span style="color:green;">Treat the result as an array of ''p'' elements, each entry being ''blocksize'' bytes (e.g. 3 elements, each 1024 bytes)</span>
    [B<sub>0</sub>...B<sub>p−1</sub>] ← [[PBKDF2]]<sub>HMAC-SHA256</sub>(''Passphrase'', ''Salt'', 1, blockSize*ParallelizationFactor)
 
    <span style="color:green;">Mix each block in '''B''' Costfactor times using '''ROMix''' function (each block can be mixed in parallel)</span>
    <span style="color:blue;">'''for'''</span> i ← 0 <span style="color:blue;">'''to'''</span> p-1 <span style="color:blue;">'''do'''</span>
       B<sub>i</sub> ← ROMix(B<sub>i</sub>, CostFactor)
 
    <span style="color:green;">All the elements of B is our new "expensive" salt</span>
    expensiveSalt ← B<sub>0</sub>∥B<sub>1</sub>∥B<sub>2</sub>∥ ... ∥B<sub>p-1</sub>  <span style="color:green;">''// where ∥ is concatenation</span>
  
    <span style="color:green;">''Step 2. Use PBKDF2 to generate the desired number of bytes, but using the expensive salt we just generated''</span>
    <span style="color:blue;">'''return'''</span> PBKDF2<sub>HMAC-SHA256</sub>(Passphrase, expensiveSalt, 1, DesiredKeyLen);

== 같이 보기 ==
* [[Argon2]]
* [[Bcrypt]]
* [[키 유도 함수]]
* [[PBKDF2]]

== 외부 링크 ==
* [https://www.tarsnap.com/scrypt.html The scrypt page on the Tarsnap website.]
* [https://www.tarsnap.com/scrypt/scrypt.pdf The original scrypt paper.]
* {{GitHub|https://github.com/Tarsnap/scrypt}}

{{암호화 해시}}
{{암호학}}
{{암호화폐}}

[[분류:암호화 해시 함수]]
[[분류:암호 알고리즘]]