{"id":13420456,"url":"https://github.com/technion/libscrypt","last_synced_at":"2025-04-07T13:09:58.054Z","repository":{"id":8722185,"uuid":"10393543","full_name":"technion/libscrypt","owner":"technion","description":"A shared library that implements scrypt() functionality - a replacement for bcrypt()","archived":false,"fork":false,"pushed_at":"2022-02-10T06:31:31.000Z","size":133,"stargazers_count":119,"open_issues_count":5,"forks_count":44,"subscribers_count":13,"default_branch":"master","last_synced_at":"2024-10-01T09:19:23.425Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/technion.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2013-05-30T22:38:53.000Z","updated_at":"2024-07-26T10:04:24.000Z","dependencies_parsed_at":"2022-09-05T00:51:02.438Z","dependency_job_id":null,"html_url":"https://github.com/technion/libscrypt","commit_stats":null,"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/technion%2Flibscrypt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/technion%2Flibscrypt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/technion%2Flibscrypt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/technion%2Flibscrypt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/technion","download_url":"https://codeload.github.com/technion/libscrypt/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247657281,"owners_count":20974345,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-30T22:01:34.055Z","updated_at":"2025-04-07T13:09:58.019Z","avatar_url":"https://github.com/technion.png","language":"C","funding_links":[],"categories":["TODO scan for Android support in followings"],"sub_categories":[],"readme":"libscrypt\n=========\nLinux scrypt shared library.\n\nFull credit to algorithm designer and example code from Colin Percival here:\nhttp://www.tarsnap.com/scrypt.html\n\nUtilises BASE64 encoding library from ISC.\n\nOfficial project page, including stable tarballs found here:\nhttp://www.lolware.net/libscrypt.html\n\nSimple hashing interface\n\nThe (reference) internal hashing function can be directly called as follows:\n\n    int libscrypt_scrypt(const uint8_t *passwd, size_t passwdlen,\n            const uint8_t *salt, size_t saltlen, uint64_t N, uint32_t r, \n            uint32_t p, /*@out@*/ uint8_t *buf, size_t buflen);\n\nLibscrypt's easier to use interface wraps this up to deal with the salt and produce BASE64 output as so:\n\n    int libscrypt_hash(char *dst, char *passphrase, uint32_t N, uint8_t r, uint8_t p);\n\nSane constants have been created for N, r and p so you can create a hash like this:\n\n    libscrypt_hash(outbuf, \"My cats's breath smells like cat food\", SCRYPT_N, SCRYPT_r, SCRYPT_p);\n\nThis function sets errno as required for any error conditions.\n\nOutput stored in \"outbuf\" is stored in a standardised MCF form, which means includes the randomly created, 128 bit salt, all N, r and p values, and a BASE64 encoded version of the hash. The entire MCF can be stored in a database, and compared for use as below:\n\n    retval = libscrypt_check(mcf, \"pleasefailme\");\n    retval \u003c 0 error\n    retval = 0 password incorrect\n    retval \u003e 0 pass\n\nmcf should be defined as at least SCRYPT_MCF_LEN in size.\n\nNote that libscrypt_check needs to modify the mcf string and will not return it\nto the original state. Pass it a copy if you need to keep the original mcf.\n\nA number of internal functions are exposed, and users wishing to create more complex use cases should consult the header file, which is aimed at documenting the API fully.\n\nThe test reference is also aimed at providing a well documented use case.\nBuilding\n--------\n    make\n    make check\nCheck the Makefile for advice on linking against your application.\n\nOSX\n-----\nPlease compile and install with:\n\n    make LDFLAGS= CFLAGS_EXTRA=\n    make install-osx\n\n\nBUGS\n----\nSCRYPT_* constants are probably a little high for something like a Raspberry pi. Using '1' as SCRYPT_p is acceptable from a security and performance standpoint if needed. \nExperiments were performed with using memset() to zero out passwords as they were checked. This often caused issues with calling applications where the password based have been passed as a const*. We highly recommend implementing your own zeroing function the moment this library is called.\n\nThere is apparently an issue when used on Samsung (and perhaps Android in general) devices. See [this issue](https://github.com/technion/libscrypt/issues/39) for more information.\n\nNotes on Code Development\n------------------------\n\nCode is now declared \"stable\", the master branch will always be \"stable\" and development will be done on branches.\nThe reference machines are Fedora, CentOS, FreeBSD and Raspbian, and the code is expected to compile and run on all of these before being moved to stable branch.\nFull transparancy on the regular application of thorough testing can be found by reviewing recent test harness results here:\nhttp://www.lolware.net/libscrypttesting.txt\n\nPlease, no more pull requests for Windows compatibility. If it's important to you - fork the project. I have no intention of pulling an OpenSSL and becoming a maze of ifdefs for platforms I don't even have a build environment for.\n\nI utilise Facebook's \"infer\" static analyser, in addition to clang's analyzer. Command to run is:\n\n    infer -- make\n\nContact\n-------\nI can be contacted at: technion@lolware.net\n\nIf required, my GPG key can be found at: https://lolware.net/technion-GPG-KEY\n\nFuture releases will have the Git tag signed.\n\n\nChangenotes\n-----------\nv1.1a: Single Makefile line change. I wouldn't ordinarily tag this as a new \"release\", but the purpose here is to assist with packaging in distributions.\n\nv1.12: The static library is built, but no longer installed by default. You can install it with \"make install-static\". This is because static libraries are not typically bundled in packages.\n\nv1.13: Minor packaging related update\n\nv1.15: Replaced the b64 libraries with more portable one from ISC. Now tested and verified on a wider variety of architectures. Note, libscrypt_b64_encrypt was originally an exported function. This is no longer the case as it is considered an internal function only.\n\nv1.18: God damnit Apple\n\nv1.19: Code safety cleanups. Now running Coverity.\n\nv1.20: Bigfixes involving large N values, return values on error\n\n\u003ca href=\"https://scan.coverity.com/projects/2173\"\u003e\n  \u003cimg alt=\"Coverity Scan Build Status\"\n         src=\"https://scan.coverity.com/projects/2173/badge.svg\"/\u003e\n \u003c/a\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftechnion%2Flibscrypt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftechnion%2Flibscrypt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftechnion%2Flibscrypt/lists"}