|SCRYPT(1)||General Commands Manual||SCRYPT(1)|
encencrypts infile and writes the result to outfile if specified, or the standard output otherwise. The user will be prompted to enter a passphrase (twice) to be used to generate a derived encryption key.
decrypts infile and writes the result to
outfile if specified, or the standard output
otherwise. The user will be prompted to enter the passphrase used at
encryption time to generate the derived encryption key.
-P is not given,
scrypt reads passphrases from its controlling
terminal, or failing that, from stdin. Prompts are only printed when
scrypt is reading passphrases from some terminal. If
-P is given, then
does not print any prompts, and reads a passphrase from stdin.
- Force the decryption to proceed even if it is anticipated to require an excessive amount of memory or CPU time.
- Use at most maxmem bytes of RAM to compute the derived encryption key.
- Use at most the fraction maxmemfrac of the available RAM to compute the derived encryption key.
- Use at most maxtime seconds of CPU time to compute the derived encryption key.
- Always read passphrase from stdin, and do so only once even when encrypting.
- Print version of scrypt, and exit.
memory and CPU time limits are enforced by picking appropriate parameters to
scrypt key derivation function. In
dec, the memory and
CPU time limits are enforced by exiting with an error if decrypting the file
would require too much memory or CPU time.
scryptutility exits 0 on success, and >0 if an error occurs.
Note that if the input encrypted file is corrupted,
dec may produce
output prior to determining that the input was corrupt and exiting with a
non-zero status; so users should direct the output to a safe location and
check the exit status of
scrypt before using the
Colin Percival, Stronger Key Derivation via Sequential Memory-Hard Functions, May 2009, Presented at BSDCan'09.
scryptutility was written in May 2009 by Colin Percival as a demonstration of the
scryptkey derivation function. The
scryptkey derivation function was invented in March 2009 by Colin Percival in order to allow key files from the
tarsnapbackup system to be passphrase protected.