What's the advantage of scrypt over bcrypt?

security bcrypt
Hongli picture Hongli · Aug 4, 2009 · Viewed 12.1k times · Source

I'm looking at ways to securely store passwords. Some people claim that scrypt is "better" than bcrypt, and so far I've seen nobody who claims vice versa or that scrypt is insecure, though some call bcrypt "more reputable".

What's the advantage of scrypt over bcrypt? According to the scrypt website, "the cost of a hardware brute-force attack against scrypt is roughly 4000 times greater than the cost of a similar attack against bcrypt". If that's the only advantage then can't I just use bcrypt with a larger number of rounds?

Answer

orip picture orip · Aug 5, 2009

With scrypt in addition to increasing computation you can increase the amount of memory needed to compute the hash. This doesn't bother software implementations much but is much harder to implement with hardware - which is what a dedicated attacker is likely to develop and use.

bcrypt (and PBKDF2) use constant, and small, amounts of memory.

Related questions

How can bcrypt have built-in salts?

Coda Hale's article "How To Safely Store a Password" claims that: bcrypt has salts built-in to prevent rainbow table attacks. He cites this paper, which says that in OpenBSD's implementation of bcrypt: OpenBSD generates the 128-bit bcrypt salt from an …

Read More
Is Bcrypt used for Hashing or Encryption? A bit of confusion

I have been reading about bcrypt (application perspective). Thinking of using it to store passwords on my site. Out of some stuff that I read it suggests either ways: e.g. 1: Bcrypt is a cross platform file encryption utility from …

Read More
strcmp vs. == vs. === in PHP for checking hash equality

I'm using crypt() to hash passwords in PHP, and am trying to work out the safest way of testing equality of the resulting hash when performing password checks. There are three options that I can see: Option 1 - Double Equals …

Read More