# Benchmark differences between SHA-512 and bcrypt

So I recently made a benchmark SHA-512 vs bcrypt with hashcat CUDA.

Here are the results :

bcrypt : bruteforce : ~                              400 H/s
Wordlist + dive.rule :  ~                   550 H/s

sha512 : bruteforce : ~          870 MH/s ->   870000000 H/s
Wordlist + dive.rule :  ~ 640 MH/s -> 640000000 H/s

Factor sha512 -> bcrypt : 1:1589473


SHA-512 is a cryptographic hash function right? So why is it so fast?

For example VeraCrypt uses it as KDF .

I am still a beginner so please explain to me in which scenarios SHA-512 is used and in which bcrypt.

SHA-512 is a cryptographic hash while bcrypt is a password hash or PBKDF (password based key derivation function).

SHA-512 has been designed to be fast. You don't want any delays when validating a signature, for instance. There is no reason for generic cryptographic hashes to be slow.

bcrypt on the other hand is a password hash that performs key strengthening on the input. Basically it does this by slowing down the calculation so that attackers will have to spend more resources to find the input by brute forcing or dictionary attacks. The idea is that although the legit users - you in this case - will also be slowed down, they are only slowed down once per password. However the attackers are slowed down for each try. The legit user is of course much more likely to input the right password first.

Furthermore bcrypt also contains a salt as input, which can be used to avert rainbow table attacks.

SHA-512 officially is not a KDF in it's own right, but it is easy to construct one out of a hash function. PBKDF2 for instance is a password hash / password based KDF. It can use any hash function as underlaying primitive. The larger function takes again a salt and a work factor as input / configuration parameters.

However, if you don't need key strengthening - i.e. the input is random enough - then you can also (almost) directly use a hash to derive the symmetric key. This is called a KBKDF (key based key derivation function). The most well known one today is HKDF which is based on HMAC, which in turn is based on a cryptographic hash such as SHA-512.

There is also KDF1 and KDF2 which can simply consist of the input secret followed by a statically counter, which is then hashed. Although it has limitations with regards to the input and output sizes, it is a secure KDF to the current knowledge - assuming that the hash is pseudo random and collision free for small input.

In some scenarios even a direct hash over the input value may suffice (taking the leftmost bits if the hash generates too many). HMAC - as for instance used by TLS - should be preferred though.