2
$\begingroup$

I am using SSHA512 to encrypt email user's passwords. Manually doing this works using doveadm from dovecot. But I can't seem to implement this in my mail client. I can, however, use SHA512.

Is SHA512 less secure than SSHA512?

$\endgroup$
  • $\begingroup$ After a quick search I found this code which shows you how not to implement the SSHA-512 algorithm in Java, but if you have any issues implementing it you can always ask on StackOverflow. $\endgroup$ – Maarten Bodewes Oct 27 '18 at 21:05
4
$\begingroup$

Is SHA512 less secure than SSHA512?

Hashing passwords plainly with SHA512 is indeed less secure than using SSHA512. But note that this doesn't imply that using SSHA512 is actually a good / secure method for hashing your passwords.

The reason for the inequality is simple:

$$\operatorname{SSHA512}(\text{pw},\text{salt})=\operatorname{SHA512}(\text{pw}\parallel \text{salt})\parallel \text{salt}$$

So as you can see it's a case of a single iteration of SHA-512 paired with some basic salting. Salting is a good thing as it (among other things) thwarts rainbow-tables but of course a modern GPU (like the Tesla V100 or with nearly the same speed the RTX 2080 Ti) achieves about 1.8GH/s per card. That is $1.8\cdot 10^9$ SHA512 evaluations per second and per card. Also note that for about 25 USD/hr you can rent 8 of these on AWS which gives you about 2.1 TH/USD, that is an attacker can try about $2\ 000\ 000\ 000\ 000$ password hashes for a single US-Dollar. So if the user has any even remotely weak password, it's a matter of a few USD to break it.

The more modern approach is then to use Argon2 or bcrypt instead which perform much worse on GPUs.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.