How to enable scrypt algorithm in OpenSSL

Question

I'm trying to enable scrypt algorithm in OpenSSL 1.1.0 on Cygwin. I used configure option enable-scrypt but it does not work.

Command for build OpenSSL:

perl configure Cygwin-x86_64 --prefix="C:/OpenSSL/x64/" no-shared -static enable-scrypt

How to activate scrypt algorithm in OpenSSL?

jww · Answer 1 · 2017-07-26T23:54:21.030

Enable scrypt algorithm in OpenSSL...

It looks like you enabled it, but it appears scrypt is only available as part of PBE gear. There is no separate EVP algorithm for it per se. That is, you can't ask for a EVP_scrypt hash algorithm.

Below is from Linux (not Windows) using 1.1.0 in Master. It used the same flags you used.

$ nm -D libcrypto.a 2>/dev/null | grep -i scrypt
p5_scrypt.o:
scrypt.o:

$ nm crypto/evp/scrypt.o
                 U CRYPTO_clear_free
                 U CRYPTO_malloc
                 U ERR_put_error
00000000000004d0 T EVP_PBE_scrypt
                 U EVP_sha256
                 U OPENSSL_cleanse
                 U PKCS5_PBKDF2_HMAC
0000000000000000 t scryptBlockMix

$ cat include/openssl/evp.h | grep -i scrypt
#ifndef OPENSSL_NO_SCRYPT
int EVP_PBE_scrypt(const char *pass, size_t passlen,
int PKCS5_v2_scrypt_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass,

You can verify OPENSSL_NO_SCRYPT is not defined with:

$ cat include/openssl/opensslconf.h | grep OPENSSL_NO_SCRYPT
$

Based on the above, your two choices are EVP_PBE_scrypt and PKCS5_v2_scrypt_keyivgen. With that toehold, there does not appear to be man pages:

openssl$ grep -R EVP_PBE_scrypt doc/
openssl$

openssl$ grep -R PKCS5_v2_scrypt_keyivgen doc/
openssl$

You gotta love self-documenting code :)

Here's some more information from p5_scrypt.o, but it does not look as useful as scrypt.o. Ignore everything with a U. The only thing left that looks mildly interesting is T PKCS5_pbe2_set_scrypt (and friends), which appears to set a context option.

$ nm crypto/asn1/p5_scrypt.o
                 U ASN1_INTEGER_get_uint64
                 U ASN1_INTEGER_it
                 U ASN1_INTEGER_new
                 U ASN1_INTEGER_set_int64
                 U ASN1_INTEGER_set_uint64
                 U ASN1_OCTET_STRING_it
                 U ASN1_STRING_set
                 U ASN1_TYPE_new
                 U ASN1_TYPE_pack_sequence
                 U ASN1_TYPE_unpack_sequence
                 U ASN1_item_d2i
                 U ASN1_item_free
                 U ASN1_item_i2d
                 U ASN1_item_new
                 U ERR_put_error
                 U EVP_CIPHER_CTX_cipher
                 U EVP_CIPHER_CTX_free
                 U EVP_CIPHER_CTX_key_length
                 U EVP_CIPHER_CTX_new
                 U EVP_CIPHER_iv_length
                 U EVP_CIPHER_key_length
                 U EVP_CIPHER_param_to_asn1
                 U EVP_CIPHER_type
                 U EVP_CipherInit_ex
                 U EVP_PBE_scrypt
                 U OBJ_nid2obj
                 U OPENSSL_cleanse
                 U PBE2PARAM_free
                 U PBE2PARAM_it
                 U PBE2PARAM_new
0000000000000030 T PKCS5_pbe2_set_scrypt
00000000000003f4 T PKCS5_v2_scrypt_keyivgen
                 U RAND_bytes
0000000000000024 T SCRYPT_PARAMS_free
0000000000000000 R SCRYPT_PARAMS_it
0000000000000018 T SCRYPT_PARAMS_new
0000000000000038 r SCRYPT_PARAMS_seq_tt
                 U X509_ALGOR_free
                 U X509_ALGOR_new
0000000000000000 T d2i_SCRYPT_PARAMS
000000000000000c T i2d_SCRYPT_PARAMS
                 U memcpy

How to enable scrypt algorithm in OpenSSL

1 Answers1