search

barrysteyn / node-scrypt

Scrypt for Node
370 stars 88 forks source link

Since this is deprecated, what is the recommended equivalent of scrypt.params? #198

Open fresheneesz opened 4 years ago

fresheneesz commented 4 years ago

scrypt.params is important because it allows you to choose an appropriate timeout for key stretching. Choosing a constant value for N would mean that your password storage would become easier and easier to crack over time. Since this is now recommending using node.js's crypto.script function instead, what is the recommended equivalent for scrypt.params to generate an N based on a maximum key stretching time?

swansontec commented 4 years ago

You can see the algorithm in the source code. It shouldn't be too hard to convert this to Javascript.

However, it looks like this has already been done over in scrypt-kdf. See the pickParameters function.

fresheneesz commented 4 years ago

https://github.com/barrysteyn/node-scrypt/pull/200