The scrypt parameters
Password hashing functions are very useful, but can cause operational issues.<p>A common advice is to allocate as much memory as possible, and as much CPU as possible, to make bruteforce attacks as long as possible.<p>Unfortunately, it only makes sense if a each user is assigned a dedicated server. Which is almost never the case in APIs and web applications.<p>Doing all the stretching work on a server scales poorly. And predicting how many users will try to log in is impossible, unless you set up drastic limits. One way or the other, this makes the whole service vulnerable to very cheap denial of service attacks.<p>There are a lot of discussions about password hashing functions and their parameters, but almost none about server relief, which is far more important IMHO.<p>The idea is to delegate most of the work to the client. The server just provides the salt. It&#x27;s acceptable to use as much resources as possible for a short time on the client, since it&#x27;s unlikely to do anything else important at the same time.<p>The stretched password is sent to the server instead of the actual password, so that it&#x27;s acceptable for the server to  keep the stretching work down to a minimum before storing the password. This also has the advantage that the server doesn&#x27;t see the actual password.<p>This solves scalability issues, and drastically reduces to ability to perform cheap resources exhaustion attacks on the servers.<p>In a webapp, this can be efficiently achieved using WebAssembly, or  with WebCrypto&#x27;s PBKDF2 implementation. Obviously not an issue in native apps either.<p>Legacy protocols such as FTP and IMAP don&#x27;t have that luxury, though. There&#x27;s no way to run a password stretching function on the client.
So, while it&#x27;s nice to see software like Dovecot adopt functions like Argon2 to store passwords, this can actually do more harm than good.<p>Finally, while password hashing functions are typically described as suitable for storing passwords, they have other usages as well.<p>Password-authenticated key exchange mechanisms such as SPAKE2 don&#x27;t get the attention they deserve. They can be extremely useful to add a strong security layer on top of another authentication mechanism, using a simple password. And they also usually leverage password stretching functions.