boughtonp
commented
4 years ago Already using latest wg/scrypt 1.4.0, which maps to Tarsnap/scrypt 1.1.6
Tarsnap/scrypt has three newer tagged versions (1.2.0, 1.2.1, 1.3.0) but: 1) the Tarsnap repo contains more than just the scrypt algorithm 2) there is excessive refactoring making the real changes hard to decipher
The only change I can see for sure is one to ensure that r and p (Memory cost and Parallelization) do not accept values of zero.
Two options for solving this issue:
-
Switch to using an updated fork of wg/scrypt - https://github.com/lhunath/scrypt appears to be most up to date. (It doesn't appear to have the zero checks, but does have other valid improvements to the code.)
-
Use a yescrypt implementation for scrypt support - yescrypt is a new algorithm that extends scrypt (and can generate standard scrypt hashes), but I've yet to find a Java implementation.
(Deferred from v0.2 to a later release.)
Check latest versions for official scrypt and Java port - identify current version & upgrade.