NAME

Crypt::LibScrypt - scrypt password hashing using libscrypt

SYNOPSIS

use Crypt::LibScrypt;

my $password =  'somepa55word';

my $hash     =  scrypt-hash($password);

if scrypt-verify($hash, $password ) {

    #  password ok

}

DESCRIPTION

This module provides a binding to the scrypt password hashing functions provided by libscrypt.

The Scrypt algorithm is designed to be prohibitively expensive in terms of time and memory for a brute force attack, so is considered relatively secure. However this means that it might not be suitable for use on resource constrained systems.

The hash returned by scrypt-hash is in the format used in /etc/shadow and can be verified by other libraries that understand the Scrypt algorithm ( such as the libxcrypt that is used for password hashing on some Linux distributions.)

scrypt-hash takes three optional positional arguments that control the cost of the hashing, the defaults are those suggested by the library, however they may be too strong for some applications:

• $N CPU AND RAM cost (first modifier)

This must be a power of two greater than one. The default is 16384, typically you only need to change this to modify the performance

• $r RAM Cost

This has a default of 8

• $p CPU cost (parallelisation)

This has a default of 1 which differs from the default constant in the library but is the value suggested in the comments in the header file.

$r and $p typically only need adjusting if you want to adjust the ratio between RAM and CPU.

The scrypt-verify may not be able to verify passwords against Scrypt hashes produced by other libraries (that is the hash has the prefix $7$, whereas this library will generate $s1$. )