Re: scrypt: Decrypting file would require too much memory

[Christoph Borsbach <christoph+tarsnap@borsbach.org>]

On Thu, Oct 15, 2015 at 13:33:30 -0700, Colin Percival wrote:
> On 10/15/15 00:38, Christoph Borsbach wrote:
> > On Wed, Oct 14, 2015 at 21:53:21 -0700, Colin Percival wrote:
> >> On 10/14/15 21:01, Christoph Borsbach wrote:
> >>> On Wed, Oct 14, 2015 at 19:52:30 -0700, Colin Percival wrote:
> >>>> How much memory does this system have?  Did you encrypt the file on the same
> >>>> system?  If you encrypt a new file now, can you decrypt it?  Has anything
> >>>> changed on the system since you encrypted the file?
> >>>
> >>> The system has 2GB of memory and I can encrypt and decrypt new files just
> >>> fine. But I traced my steps and I actually did the last encryption on another
> >>> system: scrypt 1.2 on OSX. (I actually forgot that). So that might be it? It
> >>> is still a bit strange that I can decrypt the file on Linux and scrypt 1.1.6.
> >>
> >> How much memory did the OS X system have?
> > 
> > 8 GB
> 
> Ok, this may just be a matter of the OS X box legitimately encrypting using
> more memory than the OpenBSD box has, then.
> 
> The relevant limits value is the datasize, not the stacksize.  But to answer
> your question, scrypt uses a large amount of memory -- the larger the better
> -- to convert your passphrase into the key used for encryption; so this is
> entirely independent of the amount of data you're processing.

I have access to another OpenBSD System with 6 GB Ram. I cranked the datasize
limit to ~5GB and still I get the same error: 

$ ulimit -a
time(cpu-seconds)    unlimited
file(blocks)         unlimited
coredump(blocks)     unlimited
data(kbytes)         5316608
stack(kbytes)        4096
lockedmem(kbytes)    2026642
memory(kbytes)       6078248
nofiles(descriptors) 512
processes            256

Anyway, do I understand the -M option to scrypt correctly that if I use, say,
-M 536870912 (512MB), on all of my machines, it should decrypt on all machines
(that have a ulimit of 512MB or more) without error? 

Thanks again!

Christoph