Yescrypt for Node.js

Prerequisites

• Node.js LTS

Install

$ yarn add yescrypt

Build

$ yarn

Example Code

import { yescrypt_kdf } from './index.js';

const getRandomHex = () => Buffer.from(crypto.getRandomValues(new Uint8Array(32)));

const passwd = Buffer.from("7000000001e980924e4e1109230383e66d62945ff8e749903bea4336755c00000000000051928aff1b4d72416173a8c3948159a09a73ac3bb556aa6bfbcad1a85da7f4c1d13350531e24031b939b9e2b", "hex");

// Use random value for secure KDF
const salt = getRandomHex();

console.log(yescrypt_kdf(passwd, salt).toString('hex'));

API

scrypt_kdf  (passwd, salt, N?, r?, p?, t?, flags?, g?, dklen?): Buffer
yescrypt_kdf(passwd, salt, N?, r?, p?, t?, flags?, g?, dklen?): Buffer
scrypt_hash (passwd, salt, N?, r?, p?, t?, flags?, g?): string   // "$y$..." crypt(3) form
yescrypt_hash(passwd, salt, N?, r?, p?, t?, flags?, g?): string

These map onto the C yescrypt_params_t (yescrypt-c/yescrypt.h). flags accepts the YESCRYPT_* constants OR'ed together (default 0 for scrypt_*, YESCRYPT_DEFAULTS = 182 for yescrypt_*); g is the hash-upgrade count (default 0); dklen is the *_kdf output length in bytes (default 64). The byte length of passwd/salt is honored exactly, so binary and >=20-byte passwords hash identically to the C reference. ROM (NROM / shared) is not yet exposed.

Invalid parameters throw a RangeError (e.g. N not a power of two > 1, or r * p >= 2^30) instead of silently returning a zeroed result.

import { yescrypt_hash } from './index.js';

const passwd = Buffer.from('a'.repeat(20));
const salt = Buffer.from(crypto.getRandomValues(new Uint8Array(16)));

// crypt(3)-style encoded hash suitable for /etc/shadow:
console.log(yescrypt_hash(passwd, salt));

Async (non-blocking)

The KDF is CPU-heavy; the synchronous functions block the event loop for the duration of the hash. Each function also has an _async variant that runs on the libuv threadpool and returns a Promise, leaving the event loop free. Inputs are copied, so the passwd/salt buffers may be reused immediately.

import { yescrypt_hash_async } from './index.js';

const hash = await yescrypt_hash_async(passwd, salt);

Signatures mirror the sync versions: scrypt_kdf_async, yescrypt_kdf_async, scrypt_hash_async, yescrypt_hash_async. The returned Promise rejects with a RangeError on invalid parameters.

References

Yescrypt

Yescrypt-NAPI