Source: scrypt.js

  1. /** scrypt Password-Based Key-Derivation Function.
  2.  *
  3.  * @param {bitArray|String} password  The password.
  4.  * @param {bitArray|String} salt      The salt.  Should have lots of entropy.
  5.  *
  6.  * @param {Number} [N=16384] CPU/Memory cost parameter.
  7.  * @param {Number} [r=8]     Block size parameter.
  8.  * @param {Number} [p=1]     Parallelization parameter.
  9.  *
  10.  * @param {Number} [length] The length of the derived key.  Defaults to the
  11.  *                          output size of the hash function.
  12.  * @param {Object} [Prff=sjcl.misc.hmac] The pseudorandom function family.
  13.  *
  14.  * @return {bitArray} The derived key.
  15.  */
  16. sjcl.misc.scrypt = function (password, salt, N, r, p, length, Prff) {
  17.   var SIZE_MAX = Math.pow(2, 32) - 1,
  18.       self = sjcl.misc.scrypt;
  20.   N = N || 16384;
  21.   r = r || 8;
  22.   p = p || 1;
  24.   if (r * p >= Math.pow(2, 30)) {
  25.     throw sjcl.exception.invalid("The parameters r, p must satisfy r * p < 2^30");
  26.   }
  28.   if ((N < 2) || (N & (N - 1) != 0)) {
  29.     throw sjcl.exception.invalid("The parameter N must be a power of 2.");
  30.   }
  32.   if (N > SIZE_MAX / 128 / r) {
  33.     throw sjcl.exception.invalid("N too big.");
  34.   }
  36.   if (r > SIZE_MAX / 128 / p) {
  37.     throw sjcl.exception.invalid("r too big.");
  38.   }
  40.   var blocks = sjcl.misc.pbkdf2(password, salt, 1, p * 128 * r * 8, Prff),
  41.       len = blocks.length / p;
  43.   self.reverse(blocks);
  45.   for (var i = 0; i < p; i++) {
  46.     var block = blocks.slice(i * len, (i + 1) * len);
  47.     self.blockcopy(self.ROMix(block, N), 0, blocks, i * len);
  48.   }
  50.   self.reverse(blocks);
  52.   return sjcl.misc.pbkdf2(password, blocks, 1, length, Prff);
  53. };
  55. sjcl.misc.scrypt.salsa20Core = function (word, rounds) {
  56.   var R = function(a, b) { return (a << b) | (a >>> (32 - b)); };
  57.   var x = word.slice(0);
  59.   for (var i = rounds; i > 0; i -= 2) {
  60.     x[ 4] ^= R(x[ 0]+x[12], 7);  x[ 8] ^= R(x[ 4]+x[ 0], 9);
  61.     x[12] ^= R(x[ 8]+x[ 4],13);  x[ 0] ^= R(x[12]+x[ 8],18);
  62.     x[ 9] ^= R(x[ 5]+x[ 1], 7);  x[13] ^= R(x[ 9]+x[ 5], 9);
  63.     x[ 1] ^= R(x[13]+x[ 9],13);  x[ 5] ^= R(x[ 1]+x[13],18);
  64.     x[14] ^= R(x[10]+x[ 6], 7);  x[ 2] ^= R(x[14]+x[10], 9);
  65.     x[ 6] ^= R(x[ 2]+x[14],13);  x[10] ^= R(x[ 6]+x[ 2],18);
  66.     x[ 3] ^= R(x[15]+x[11], 7);  x[ 7] ^= R(x[ 3]+x[15], 9);
  67.     x[11] ^= R(x[ 7]+x[ 3],13);  x[15] ^= R(x[11]+x[ 7],18);
  68.     x[ 1] ^= R(x[ 0]+x[ 3], 7);  x[ 2] ^= R(x[ 1]+x[ 0], 9);
  69.     x[ 3] ^= R(x[ 2]+x[ 1],13);  x[ 0] ^= R(x[ 3]+x[ 2],18);
  70.     x[ 6] ^= R(x[ 5]+x[ 4], 7);  x[ 7] ^= R(x[ 6]+x[ 5], 9);
  71.     x[ 4] ^= R(x[ 7]+x[ 6],13);  x[ 5] ^= R(x[ 4]+x[ 7],18);
  72.     x[11] ^= R(x[10]+x[ 9], 7);  x[ 8] ^= R(x[11]+x[10], 9);
  73.     x[ 9] ^= R(x[ 8]+x[11],13);  x[10] ^= R(x[ 9]+x[ 8],18);
  74.     x[12] ^= R(x[15]+x[14], 7);  x[13] ^= R(x[12]+x[15], 9);
  75.     x[14] ^= R(x[13]+x[12],13);  x[15] ^= R(x[14]+x[13],18);
  76.   }
  78.   for (i = 0; i < 16; i++) word[i] = x[i]+word[i];
  79. };
  81. sjcl.misc.scrypt.blockMix = function(blocks) {
  82.   var X = blocks.slice(-16),
  83.       out = [],
  84.       len = blocks.length / 16,
  85.       self = sjcl.misc.scrypt;
  87.   for (var i = 0; i < len; i++) {
  88.     self.blockxor(blocks, 16 * i, X, 0, 16);
  89.     self.salsa20Core(X, 8);
  91.     if ((i & 1) == 0) {
  92.       self.blockcopy(X, 0, out, 8 * i);
  93.     } else {
  94.       self.blockcopy(X, 0, out, 8 * (i^1 + len));
  95.     }
  96.   }
  98.   return out;
  99. };
  101. sjcl.misc.scrypt.ROMix = function(block, N) {
  102.   var X = block.slice(0),
  103.       V = [],
  104.       self = sjcl.misc.scrypt;
  106.   for (var i = 0; i < N; i++) {
  107.     V.push(X.slice(0));
  108.     X = self.blockMix(X);
  109.   }
  111.   for (i = 0; i < N; i++) {
  112.     var j = X[X.length - 16] & (N - 1);
  114.     self.blockxor(V[j], 0, X, 0);
  115.     X = self.blockMix(X);
  116.   }
  118.   return X;
  119. };
  121. sjcl.misc.scrypt.reverse = function (words) { // Converts Big <-> Little Endian words
  122.   for (var i in words) {
  123.     var out = words[i] &  0xFF;
  124.     out = (out << 8) | (words[i] >>>  8) & 0xFF;
  125.     out = (out << 8) | (words[i] >>> 16) & 0xFF;
  126.     out = (out << 8) | (words[i] >>> 24) & 0xFF;
  128.     words[i] = out;
  129.   }
  130. };
  132. sjcl.misc.scrypt.blockcopy = function (S, Si, D, Di, len) {
  133.   var i;
  135.   len = len || (S.length - Si);
  137.   for (i = 0; i < len; i++) D[Di + i] = S[Si + i] | 0;
  138. };
  140. sjcl.misc.scrypt.blockxor = function(S, Si, D, Di, len) {
  141.   var i;
  143.   len = len || (S.length - Si);
  145.   for (i = 0; i < len; i++) D[Di + i] = (D[Di + i] ^ S[Si + i]) | 0;
  146. };