ScryptCalc - Portable calculator for Scrypt KDF application with UI written in Python 3.7 for Windows
ScryptCalc is a PyQt 5 UI frontend that uses hashlib's Scrypt implementation. The only dependency outside Python's bundled modules is "PyQt" version 5.12.2.
Extensive attempts have been made to clear sensitive info from the application's memory as soon as it's no longer needed and encourage deallocating and overwriting unneeded memory, but with Python being unmanaged and Qt as well underlying variable management implementations not being set in stone this only mitigates the amount of occurrences. When memory dumps are made, they might contain some of the most recent inputs and their resulting passwords. This is almost exclusively due to the string manipulation mannerisms of Qt5. By default ScryptCalc asks Windows not to create crash dumps to prevent sensitive data leakage. To allow them, set "allowdumps=1" in the config as per information that follows later.
The UI provides the ability to set Scrypt's N^2, P, and R parameters, as well as the output length in bytes and the output format.
Password, salt, and output size of max 192 characters are supported. The output can be formatted as one of the following: bin, hex, base32, base58, base64, and base85. Since the output isn't displayed in raw bytes it will of course change the number of characters in the displayed output. Higher base formats compress better and result in fewer characters.
When it comes to the Scrypt parameter N, the UI setting represents the exponent of the actual number of rounds, as per the formula N = exp^2. So for example, setting an exponent of 10 will translate into a Scrypt N = 1024.
The memory estimate for computation based on the selected parameters is displayed in the UI. Parameters are adjustable to any values that keep Scrypt's memory usage under 2GB. The limitations on how big the Scrypt parameters can get are dictated by hashlib's implementation.
Pressing ENTER in the input field will perform a computation. A finished computation will then auto-focus the "Copy result" button for convenience, so a sequence of typing the input, hitting ENTER, and following up with SPACEBAR after completion is enough to derive a password and fetch the result.
It is possible to hide all three fields by checking the relevant checkboxes. While the result is hidden it is still possible to partially or wholly select it and copy the relevant selection to clipboard.
It is also possible to clear the password field as soon as computation begins if the option is checked.
The application will flash the taskbar when it is done computing, so it can be tabbed away from or minimized while waiting for the result.
The "chain multiple passes" option takes the output bytes of one computation and feeds them back in as input for another computation while preserving the rest of the hashing parameters. A chain of up to 192 computations is possible. Aborting is possible with multiple passes because the hashing runs on a separate thread from the UI. Unfortunately the Scrypt hashing operation itself does not take any kind of cancellation token so it is not possible to outright cancel out of any operation at any point.
A three-character "fingerprint" is generated from the password. This serves as a basic verification in case of hiding the input and result that the correct value has been generated. If you are familiar with the three-character code that the password generates, you can tell if the initial password may have been mistyped without having to expose it. The fingerprint has 15 bits of entropy(32768 possible values). On the technical side, it is generated by hashing the result field with SHA3-512, converting the output to base32, and selecting three characters from that output. It is sensitive to all aspects of the output configuration, right down to the output length and base output format and thus will catch any misconfiguration.
In addition, a file named "config.txt" can be placed in the application folder containing saved parameters in this example format:
title=Browser passwords
nexp=10
r=8
p=2
length=30
salt=myUniqueSalt3056740568309530
format=hex
clearinput=1
hideinput=1
hidesalt=1
chain=1
hideresult=1
clearclipboard=1
nocopy=0
Note that not all settings need to be present in a config.
The setting "title" can be used to append a title to the running instance for a more descriptive presentation of what the config parameters are set up to be used for. Maximum length is 24 characters.
The settings "clearinput", "hideinput", "hidesalt", "hideresult", "clearclipboard" and "nocopy" can take "1"/"true"/"yes" or "0"/"false"/"no" as values.
Settings are reflected in the UI immediately on start.
Custom paths for the config file are supported. Providing the file path as a command line argument will have ScryptCalc attempt to load it on start. If it cannot, it will start with the default settings. Relative paths are understood as relative to the ScryptCalc binary's folder. If a provided file is deemed invalid or unreadable, the default "config.txt" is attempted to load. The application will start with internal default values if neither is possible.
While the application is open, the shortcut CTRL+SHIFT+Y can be used to write the current result character-by-character. This is useful for password textboxes that disallow pasting. Note that since this option is agnostic to UI context and sends raw keypresses, unexpected events can occur from using this shortcut outside of text fields. This method also does not make use of the system clipboard. Note that by default ScryptCalc runs with regular user privileges. While in this mode it will not be able to send any keypresses to applications running in administrator mode. To send the result via keypress to administrator applications ScryptCalc must itself be run as administrator. It also can't paste to Remote Desktop and probably other low-level keyboard-hooking input grabbers because the "keyboard" module doesn't catch these events correctly.
To further prevent clipboard usage by accident, the config option "nocopy" can be set in the config file. This option disables all mechanisms to copy input to clipboard, though pasting is still possible. Only the CTRL+SHIFT+Y shortcut can be used in this mode. This mode cannot be disabled once the application is running.