Background: I'm working on creating a small program to extract my messages from Signal's newly-added (beta) encrypted backup feature.
In the Signal codebase for their Android app, I noticed that instead of just hashing both the salt and passphrase once, they repeatedly hash it 250,000 times.
MessageDigest digest = MessageDigest.getInstance("SHA-512");
byte[] input = passphrase.replace(" ", "").getBytes();
byte[] hash = input;
if (salt != null) digest.update(salt);
for (int i=0;i<250000;i++) {
if (i % 1000 == 0) { EventBus.getDefault().post(new BackupEvent(BackupEvent.Type.PROGRESS, 0)); }
digest.update(hash);
hash = digest.digest(input);
}
return ByteUtil.trim(hash, 32);
(Source code can be found here)
I don't understand what benefits this offers over something that conceptually does:
sha512sum(sha512sum(concat(salt, passphrase)))
Am I correct in assuming that this does not add any extra security? Why exactly has this been done?
Additional Information:
The password for the backup is generated here and is 30 bytes long and then set contextually on line 37 of that file. This code was added in the commit 22 days ago, when encrypted backup was added and is currently only visible in the beta version of the app.
sha512^2(salt | passphrase)
is needlessly weaker thanHMAC(salt, passphrase)
. See HMAC for why. $\endgroup$ – cypherfox Mar 21 '18 at 1:23