From your blog: hashed_password = scrypt(password, salt + pepper) store(hashed_password, salt) Why aren't you storing the (N, r, p) parameters too?

From your blog: hashed_password = scrypt(password, salt + pepper) store(hashed_password, salt) Why aren't you storing the (N, r, p) parameters too? Is it because your library's "scrypt" function automatically encodes all the parameters it uses in the returned string? (This is not hypothetical; it's exactly what many scrypt implementations do.) If so, congratulations: You just stored the pepper bits in your database, because they're part of the "hashed_password" value.