bscrypt - A Cache Hard Password Hash

Steve Thomas introduces bscrypt, a password hashing and key derivation function built on ideas from bcrypt. He sorts key stretching into computationally hard, memory hard and cache hard designs, and explains that bcrypt was cache hard by accident, because its Blowfish S-boxes were small tables that slowed down GPU attackers.

He then goes through the weaknesses that shaped the new design. These include bcrypt's mishandling of null bytes and sign-extended Unicode input, and PBKDF2's habit of rerunning its full iteration work when asked for extra output. bscrypt hashes all inputs up front with BLAKE2b, uses 64-bit operations, and performs many small random table lookups. Overlapping S-boxes let the table size be set in kilobyte steps, and the state is rotated so that bits unused in one lookup feed later ones.

Benchmarks against settings matched to a GPU attacker show PBKDF2-SHA256 taking roughly 800 milliseconds for a defender, while bscrypt needs only a few milliseconds. Tuned minimum settings can reach about one millisecond per hash while staying far beyond what GPUs can crack quickly. In questions, he noted that FPGA boards with small on-chip cache slow down as table sizes grow. Practitioners should choose a cache size above typical attacker hardware, keep hashing time near 100 milliseconds, and measure single-threaded cost, since parallel hashing reduces server throughput. The code is published on GitHub.