The latest shards release broke the installation script by running postinstall scripts from the root of the dependency instead of the src folder. This can be reproduced by making a minimal shard.yml:

name: test-project
version: 0.1.0

dependencies:
  scrypt:
    github: ysbaddaden/scrypt-crystal
    branch: master

and then running shards, giving the following error:

Updating https://github.com/ysbaddaden/scrypt-crystal.git
Installing scrypt (master)
Postinstall cd ext && make
Failed cd ext && make:
/bin/sh: line 1: cd: ext: No such file or directory

Is it correct to use a half of salt length?

What dimensions of the default value? If 8 "bytes" (or 32 bits) then maybe it should return value in range "12345678abcdef01" instead of "abcdef01". Because right now it means only 4 bytes (or 16 bits).

• In src/scrypt.cr#L6 (defaults) the salt length described as 8:

module Scrypt
  DEFAULT_KEY_LEN = 32
  DEFAULT_SALT_SIZE = 8
  # ...
end

• In src/engine.cr#L22 it returns a hex string so for the default of 8 it returns just only 4 bytes (16 bits) (1 byte in hex means 00 upto ff):

def self.generate_salt(salt_size = DEFAULT_SALT_SIZE)
  Random::Secure.hex(salt_size // 2)
end

Other thing.

• Please note: for production one of SCrypt docs recommends to use salt from 64 to 128 bits length (8-16 bytes). (I don't find any proves in RFCs about that)
• In src/password.cr#L12 it clamps from 8 to 32 "halves of bytes" (4-16 bytes, 16-128 bits):

salt = Engine.generate_salt(salt_size.clamp(8, 32))

Maybe there should be used larger alphabet for salt generation instead of hex or remove the halving to prevent parameter misunderstandings. 🤔

This might be by design, but I noticed that if the hash isn't placed on the left hand side in an equality comparison, you will get a different result. Intuitively I would think order shouldn't matter.

I'm trying this library and this is really awesome!
In some cases, I caught Index out of bounds exception.

require "scrypt"

N = 1024
R = 8
P = 48
K = 256

password = "6dc36b8921df93dbdcf1d7cbfc952fd1a61db1051a0d2bbc6a9d2690228690e2"
salt = "5137391304548937013"

p ::Scrypt::Engine.crypto_scrypt(password, salt, N, R, P, K)

Is my usage of it bad?

Thanks!

This shard currently does not support Crystal 0.24 and above, which broke backwards compatibility with SecureRandom. Instead, Random::Secure should be used. It's effectively the same thing, just a name change.