What do the last chunks of the output string of Scrypt contain? When you use scrypt to hash a string, it will generate something like:

SCRYPT:4096:8:1:8zCQhTI8y2pdrFeIj2WYBJIbaLiePLOuXdbevG7XDV4qgUuiGPCXPFjh1aEmXQ/5u+SlCvz0KkcoOJtUWBkytfkCs2OZep60W+Nagv0gixqkcMn/PxoIqnOGIzyDWntEdsQKjYBHDYK5Va5VDHqoQxJeIm+yq3lJ4/y5dnL55RA=:zABi6opzkXwG627OUrk4KNUCiajY1xdM+PVmSC+VJS8=


The first part: SCRYPT:4096:8:1: is the "header" (identification and parameters used).

The second part: 

zCQhTI8y2pdrFeIj2WYBJIbaLiePLOuXdbevG7XDV4qgUuiGPCXPFjh1aEmXQ/5u+SlCvz0KkcoOJtUWBkytfkCs2OZep60W+Nagv0gixqkcMn/PxoIqnOGIzyDWntEdsQKjYBHDYK5Va5VDHqoQxJeIm+yq3lJ4/y5dnL55RA=`


I believe is the actual hash (b64 encoded).

What is the last part? zABi6opzkXwG627OUrk4KNUCiajY1xdM+PVmSC+VJS8=, the salt?

UPDATE

I found this question: https://security.stackexchange.com/questions/88678/why-does-node-js-scrypt-function-use-hmac-this-way/91050#91050


bytes 0-5: The word "scrypt"
bytes 6-15: Scrypt parameters N, r, and p
bytes 16-47: 32 bits of random salt
bytes 48-63: A 16 bit checksum
bytes 64-95: A 32 bit HMAC of bytes 0 to 63 using a key produced by the scrypt key derivation function.



To my understanding, it describes the first and second part of the resulting string described previously. Unless I'm mistaken, the last part is not discussed there.

Bottom line

As commented by Maarten Bodewes, I have found that not all libraries will output the same string as I posted above. That one is specific for the Perl library I'm using (I was unaware of that). For example, take a look to these implementations, and you will see the hash doesn't look like that:


https://github.com/pbhogan/scrypt#how-to-use-scrypt
https://github.com/barrysteyn/node-scrypt#if-random-salts-are-used-why-do-all-resulting-kdfs-start-with-c2nyexb0
I should have started here:

sub scrypt_hash {
  my ($key, $salt, $N, $r, $p) = _scrypt_extra(@_);
  return undef unless defined $key &amp;&amp; defined $salt &amp;&amp; defined $N &amp;&amp; defined $r &amp;&amp; defined $p;
  return "SCRYPT:$N:$r:$p:" . MIME::Base64::encode($salt, "") . ":" . MIME::Base64::encode($key, "");
}


It explains that the last chunk is actually the base64 encoded key (hashed password). The second part (which I thought was the hashed password), is actually the base64 encoded salt.