Standard hash function of Linux

So I went through my /etc/shadow file in Linux and discovered that my passwords were stored in SHA-512-based crypt ('sha512crypt') mode, so SHA-512. But why? I mean SHA-512 is not even a secure password hashing function. Why not bcrypt or Argon2 or scrypt .... And how much iteration does this hash even have?

PS: Does $2$ "Blowfish" mean bcrypt ? And if yes, then why do they use the name of the block cipher?

• Regarding "Does \$2 "blowfish" mean bcrypt?" bcrypt is based on the blowfish cipher, so that may be why you are seeing$2 denoted as blowfish. – puzzlepalace May 25 '17 at 21:10
• SHA512crypt is not plain sha512. It's a salted iterated scheme with security comparable to PBKDF2-HMAC-SHA2. From what I heard the construction is even uglier than PBKDF2 (no small feat), but I didn't verify that part. – CodesInChaos May 25 '17 at 21:11
• What CodesInChaos is really saying is that the indicated hash probably is a configuration parameter for the password hashing function used. This is similar of specifying the hash at the end of the TLS ciphersuites that configures the HMAC function (PRF) used. For PBKDF2 it actually goes a bit deeper: the hash configures the HMAC which is then used within the password function. – Maarten Bodewes May 25 '17 at 21:35
• @CodesInChaos my goodness were you right. It is uglier and more nonsense-filled than I ever thought possible. Like a n00b throwing a bunch of random operations together hoping that "impossible to implement securely" means secure! See akkadia.org/drepper/SHA-crypt.txt for the spec. – rmalayter May 26 '17 at 21:55

Though not my normal recommendation, the SHA-512-based password hash as implemented in Linux is a fine password hashing algorithm. It is based on a well-understood cryptographically secure hash (SHA-512). It has a significant size salt and configurable number of rounds (default 5000). I would not feel insecure with such a hashing algorithm.

$2$ is indeed bcrypt, but note there are several variants around sometimes marked 2a or 2b and sometimes not marked. So, though bcrypt is considered very secure if you need a standard password hashing function, you need to be careful when choosing bcrypt.

• how secure is bcrypt comparde to the Implementation of sha512 in Linux ? – Richard R. Matthews May 27 '17 at 15:41
• Both are entirely uncrackable using any public cryptanalytic texhnique. Brute force depends on security paramater for each but is generally unfeasable for reasonably secure passwords. It's difficult to compare. – Meir Maor May 27 '17 at 15:48
• @RichardR.Matthews Bcrypt is significantly stronger against GPU based attackers. – CodesInChaos May 28 '17 at 8:46