scrypt_ex

# Scrypt

A pure Elixir implementation of the [scrypt](https://www.rfc-editor.org/rfc/rfc7914)
password-based key derivation function (KDF), byte-exact against RFC 7914.

The memory-hard core (Salsa20/8, BlockMix, ROMix) is implemented in pure
Elixir, building on the primitives exposed by the [`salsa20`](https://hex.pm/packages/salsa20)
library. The PBKDF2-HMAC-SHA256 layers are provided by OTP's `:crypto`.

## Why byte-exact?

scrypt has no canonical file format — clients communicate N, r, p, salt and
key length out of band. Two implementations only interoperate if they derive
identical bytes from identical inputs. This library is verified against the
RFC 7914 reference vectors **and** the test vectors carried by Go's
`x/crypto/scrypt` and Python's `cryptography`, so it can be mixed freely with
other conforming implementations.

## Usage

```elixir
iex> Scrypt.scrypt("password", "NaCl", 1024, 8, 16, 64) |> Base.encode16()
"FDBABE1C9D3472007856E7190D01E9FE7C6AD7CBC8237830E77376634B3731622EAF30D92E22A3886FF109279D9830DAC727AFB94A83EE6D8360CBDFA2CC0640"
```

Raises `ArgumentError` unless `n` is a power of two greater than 1, `r > 0`,
`p > 0`, and `128 * r * p < 2^30`.

The intermediate functions `Scrypt.romix/3` and `Scrypt.blockmix/2` are exposed
(`@doc false`) so the RFC 7914 section 9/10 vectors can be tested directly.

## Parameters

* `n` - CPU/memory cost. A power of 2 greater than 1 (e.g. 2, 1024, 16384).
* `r` - block size parameter.
* `p` - parallelization parameter.
* `keylen` - derived key length in bytes.

Resources scale as `n * r * 128` bytes.