Reduce minimum scrypt cost for low-end devices.

bramble-core/src/main/java/org/briarproject/bramble/crypto/ScryptKdf.java

@@ -16,7 +16,7 @@ class ScryptKdf implements PasswordBasedKdf {
 	private static final Logger LOG =
 			Logger.getLogger(ScryptKdf.class.getName());
 
-	private static final int MIN_COST = 512; // Min parameter N
+	private static final int MIN_COST = 256; // Min parameter N
 	private static final int MAX_COST = 1024 * 1024; // Max parameter N
 	private static final int BLOCK_SIZE = 8; // Parameter r
 	private static final int PARALLELIZATION = 1; // Parameter p

bramble-core/src/test/java/org/briarproject/bramble/crypto/ScryptKdfTest.java

@@ -56,6 +56,7 @@ public class ScryptKdfTest extends BrambleTestCase {
 	@Test
 	public void testCalibration() throws Exception {
 		Clock clock = new ArrayClock(
+				0, 50, // Duration for cost 256
 				0, 100, // Duration for cost 512
 				0, 200, // Duration for cost 1024
 				0, 400, // Duration for cost 2048
@@ -65,6 +66,15 @@ public class ScryptKdfTest extends BrambleTestCase {
 		assertEquals(4096, kdf.chooseCostParameter());
 	}
 
+	@Test
+	public void testCalibrationChoosesMinCost() throws Exception {
+		Clock clock = new ArrayClock(
+				0, 2000 // Duration for cost 256 is already too high
+		);
+		PasswordBasedKdf kdf = new ScryptKdf(clock);
+		assertEquals(256, kdf.chooseCostParameter());
+	}
+
 	private static class ArrayClock implements Clock {
 
 		private final long[] times;