Is there a reason that the N value in scrypt is limited to powers of two? I have been looking at the scrypt hashing algorithm and am confused as to why the N value, which determines the overall cost, is limited to powers of two. There are only 3 things that the N value actually affects


The amount of times to mix with salsa (via two loops with N being the count)
The amount of memory required to compute a hash 
And one seemingly minor portion of mixing: 


The mixing that relies on N is this:

for (i = 0; i &lt; N; i++) {
    j = 32 * (X[16] &amp; (N-1));
    for (k = 0; k &lt; 32; k++)
        X[k] ^= V[j + k];
    xor_salsa8(&amp;X[0], &amp;X[16]);
    xor_salsa8(&amp;X[16], &amp;X[0]);
}


Would using N values that aren't a power of two compromise this mixing in some way?
The operation:

X[16] &amp; (N-1)


is really, mathematically speaking:
$$ X[16] \mathrm{\ mod\ } N $$
With a generic $N$, this operation must be done with an actual division, which is expensive; some CPU types don't provide it, and for CPU which do provide it (e.g. x86), it is quite slow (for instance, for 32-bit operands on an Intel Core2, division latency is 40 cycles). This would raise the computational cost by a non-negligible amount; correspondingly, it would decrease the memory hardness of scrypt (since, for a given CPU budget, it would be able to do less memory accesses).

However, when $N$ is a power of 2, the modulo can be done with a simple bitwise "AND", which is a matter of a single clock cycle.