So I went through my /etc/shadow file in Linux and discovered that my passwords were stored in SHA-512-based crypt ('sha512crypt') mode, so SHA-512. But why? I mean SHA-512 is not even a secure password hashing function. Why not bcrypt or Argon2 or scrypt .... And how much iteration does this hash even have?

PS: Does $2$ "Blowfish" mean bcrypt ? And if yes, then why do they use the name of the block cipher?

  • 2
    $\begingroup$ Regarding "Does \$2 "blowfish" mean bcrypt?" bcrypt is based on the blowfish cipher, so that may be why you are seeing $2 denoted as blowfish. $\endgroup$ May 25 '17 at 21:10
  • 3
    $\begingroup$ SHA512crypt is not plain sha512. It's a salted iterated scheme with security comparable to PBKDF2-HMAC-SHA2. From what I heard the construction is even uglier than PBKDF2 (no small feat), but I didn't verify that part. $\endgroup$ May 25 '17 at 21:11
  • 1
    $\begingroup$ What CodesInChaos is really saying is that the indicated hash probably is a configuration parameter for the password hashing function used. This is similar of specifying the hash at the end of the TLS ciphersuites that configures the HMAC function (PRF) used. For PBKDF2 it actually goes a bit deeper: the hash configures the HMAC which is then used within the password function. $\endgroup$
    – Maarten Bodewes
    May 25 '17 at 21:35
  • $\begingroup$ @CodesInChaos my goodness were you right. It is uglier and more nonsense-filled than I ever thought possible. Like a n00b throwing a bunch of random operations together hoping that "impossible to implement securely" means secure! See akkadia.org/drepper/SHA-crypt.txt for the spec. $\endgroup$
    – rmalayter
    May 26 '17 at 21:55

Though not my normal recommendation, the SHA-512-based password hash as implemented in Linux is a fine password hashing algorithm. It is based on a well-understood cryptographically secure hash (SHA-512). It has a significant size salt and configurable number of rounds (default 5000). I would not feel insecure with such a hashing algorithm.

$2$ is indeed bcrypt, but note there are several variants around sometimes marked 2a or 2b and sometimes not marked. So, though bcrypt is considered very secure if you need a standard password hashing function, you need to be careful when choosing bcrypt.

  • $\begingroup$ how secure is bcrypt comparde to the Implementation of sha512 in Linux ? $\endgroup$ May 27 '17 at 15:41
  • $\begingroup$ Both are entirely uncrackable using any public cryptanalytic texhnique. Brute force depends on security paramater for each but is generally unfeasable for reasonably secure passwords. It's difficult to compare. $\endgroup$
    – Meir Maor
    May 27 '17 at 15:48
  • $\begingroup$ @RichardR.Matthews Bcrypt is significantly stronger against GPU based attackers. $\endgroup$ May 28 '17 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.