Index: openacs-4/packages/acs-kernel/acs-kernel.info
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-kernel/acs-kernel.info,v
diff -u -r1.150.2.36 -r1.150.2.37
--- openacs-4/packages/acs-kernel/acs-kernel.info	1 Oct 2021 07:30:10 -0000	1.150.2.36
+++ openacs-4/packages/acs-kernel/acs-kernel.info	3 Oct 2021 18:13:39 -0000	1.150.2.37
@@ -9,15 +9,15 @@
     <implements-subsite-p>f</implements-subsite-p>
     <inherit-templates-p>t</inherit-templates-p>
 
-    <version name="5.10.1d3" url="http://openacs.org/repository/download/apm/acs-kernel-5.10.1d3.apm">
+    <version name="5.10.1d4" url="http://openacs.org/repository/download/apm/acs-kernel-5.10.1d4.apm">
         <owner url="mailto:oct@openacs.org">OpenACS Core Team</owner>
         <summary>Routines and data models providing the foundation for OpenACS-based Web services.</summary>
         <release-date>2021-09-15</release-date>
         <vendor url="http://openacs.org">OpenACS</vendor>
         <description format="text/html">The OpenACS kernel contains the core datamodel create and drop scripts for such things as objects, groups, parties and the supporting PL/SQL and PL/pgSQL procedures.</description>
         <maturity>3</maturity>
 
-        <provides url="acs-kernel" version="5.10.1d3"/>
+        <provides url="acs-kernel" version="5.10.1d4"/>
 
         <callbacks>
         </callbacks>
@@ -85,7 +85,7 @@
             <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="UseEmailForLoginP"  default="1" description="Say 1 if we should login with email instead of username." section_name="security"/>
             <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="UsePasswordWidgetForUsername"  default="0" description="Should we hide what the user types in the username field, the way we do with the password field? Set this to 1 if you are using sensitive information such as social security number for username." section_name="security"/>
             <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="SecureSessionCookie"  default="0" description="Set the session cookie as secure. This parameter should only be set, when ALL requests to the site requiring a cookie are over https." section_name="security"/>
-            <parameter scope="instance" datatype="string" min_n_values="1" max_n_values="1"  name="PasswordHashAlgorithm" default="salted_sha1" description="Define the algorithm to be used for computing password hashes; multiple algorithms can be specified in decreasing preference order (example: &#34;scram_sha_256 salted_sha1&#34;; default: &#34;salted_sha1&#34;; values are specified without quotes)." section_name="security"/>
+            <parameter scope="instance" datatype="string" min_n_values="1" max_n_values="1"  name="PasswordHashAlgorithm" default="salted_sha1" description="Define the algorithm to be used for computing password hashes; multiple algorithms can be specified in decreasing preference order (example: &#34;scram-sha-256 scrypt-16384-8-1 salted_sha1&#34;; default: &#34;salted-sha1&#34;; values are specified without quotes)." section_name="security"/>
         </parameters>
 
     </version>
Index: openacs-4/packages/acs-tcl/tcl/security-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/security-procs.tcl,v
diff -u -r1.126.2.55 -r1.126.2.56
--- openacs-4/packages/acs-tcl/tcl/security-procs.tcl	1 Oct 2021 07:30:07 -0000	1.126.2.55
+++ openacs-4/packages/acs-tcl/tcl/security-procs.tcl	3 Oct 2021 18:13:38 -0000	1.126.2.56
@@ -681,7 +681,7 @@
             hash length.  We use 15K iterations for PBKDF2 as
             recommended in RFC 7677.
 
-            @return hex encoded password hash
+            @return hex encoded password hash (64 bytes)
         } {
             return [::ns_crypto::pbkdf2_hmac \
                         -digest sha256 \
@@ -690,6 +690,19 @@
                         -salt $salt]
         }
     }
+
+    if {[::acs::icanuse "ns_crypto::scrypt"]} {
+        ad_proc -private scrypt-16384-8-1 {password salt} {
+
+            Compute a "password hash" using the scrypt password based
+            key derivation function (RFC 7914)
+
+            @return hex encoded password hash (128 bytes)
+        } {
+            return [::ns_crypto::scrypt -secret $password -salt $salt -n 16384 -r 8 -p 1]
+        }
+    }
+
 }
 
 ad_proc -public ad_check_password {