Benchmark differences between SHA-512 and bcrypt

Question

So I recently made a benchmark SHA-512 vs bcrypt with hashcat CUDA.

Here are the results :

bcrypt : bruteforce : ~                              400 H/s
         Wordlist + dive.rule :  ~                   550 H/s

sha512 : bruteforce : ~          870 MH/s ->   870000000 H/s
         Wordlist + dive.rule :  ~ 640 MH/s -> 640000000 H/s

Factor sha512 -> bcrypt : 1:1589473

SHA-512 is a cryptographic hash function right? So why is it so fast?

For example VeraCrypt uses it as KDF .

I am still a beginner so please explain to me in which scenarios SHA-512 is used and in which bcrypt.

Answer 1

SHA-512 is a cryptographic hash while bcrypt is a password hash or PBKDF (password based key derivation function).

SHA-512 has been designed to be fast. You don't want any delays when validating a signature, for instance. There is no reason for generic cryptographic hashes to be slow.

bcrypt on the other hand is a password hash that performs key strengthening on the input. Basically it does this by slowing down the calculation so that attackers will have to spend more resources to find the input by brute forcing or dictionary attacks. The idea is that although the legit users - you in this case - will also be slowed down, they are only slowed down once per password. However the attackers are slowed down for each try. The legit user is of course much more likely to input the right password first.

Furthermore bcrypt also contains a salt as input, which can be used to avert rainbow table attacks.

---

SHA-512 officially is not a KDF in it's own right, but it is easy to construct one out of a hash function. PBKDF2 for instance is a password hash / password based KDF. It can use any hash function as underlaying primitive. The larger function takes again a salt and a work factor as input / configuration parameters.

However, if you don't need key strengthening - i.e. the input is random enough - then you can also (almost) directly use a hash to derive the symmetric key. This is called a KBKDF (key based key derivation function). The most well known one today is HKDF which is based on HMAC, which in turn is based on a cryptographic hash such as SHA-512.

There is also KDF1 and KDF2 which can simply consist of the input secret followed by a statically counter, which is then hashed. Although it has limitations with regards to the input and output sizes, it is a secure KDF to the current knowledge - assuming that the hash is pseudo random and collision free for small input.

In some scenarios even a direct hash over the input value may suffice (taking the leftmost bits if the hash generates too many). HMAC - as for instance used by TLS - should be preferred though.

---

From your source (Slashdot):

For standard containers and other (i.e. non system) partitions, TrueCrypt uses at most 2,000 iterations. What Idrassi did was beef up the transformation process. VeraCrypt uses 327,661 iterations of the PBKDF2-RIPEMD160 algorithm for system partitions, and for standard containers and other partitions it uses 655,331 iterations of RIPEMD160 and 500,000 iterations of SHA-2.

So VeraCrypt - if we may believe the source - uses SHA-512 but only as configuration parameter for PBKDF2, which is a password hash just like bcrypt. So to create a fair test: compare your bcrypt with your current work factor (not present in your question, but important) and PBKDF2 with 500000 iterations. Only then compare the speed differences.