Is concatenated data hashed with scrypt vulunarable to a length extension attack? scrypt takes a salt, and a password plus some cost paramters to generate a key. So say we define it as this:

key = scrypt(password, salt, cost)


I am interested in using it for generating passwords deterministically. E.g. to create a password for amazon or apple I would so something like:

amazonpassword = base64(scrypt("username" + "masterpassword", "amazon", cost))
applepassword  = base64(scrypt("username" + "masterpassword", "apple", cost))


So I wonder if this is suspectable to a length extenson attack. E.g. if an attack found out what:

scrypt("masterpassword", "amazon", cost)


is, could they then use that as a basis for guessing what:

scrypt("username" + "masterpassword", "amazon", cost)


is? If so what is the best approach for avoiding this problem? Should I use a HMAC to generate the masterpassword string?
No, scrypt in not vulnerable to password extension attacks.

Internally, scrypt passes the password to PBKDF2, which uses it as a key for the HMAC function -- hence they've effectively already done the workaround you thought of.