I am using SSHA512 to encrypt email user's passwords. Manually doing this works using doveadm from dovecot. But I can't seem to implement this in my mail client. I can, however, use SHA512.
Is SHA512 less secure than SSHA512?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ After a quick search I found this code which shows you how not to implement the SSHA-512 algorithm in Java, but if you have any issues implementing it you can always ask on StackOverflow. $\endgroup$– Maarten Bodewes ♦Oct 27, 2018 at 21:05
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Is SHA512 less secure than SSHA512?
Hashing passwords plainly with SHA512 is indeed less secure than using SSHA512. But note that this doesn't imply that using SSHA512 is actually a good / secure method for hashing your passwords.
The reason for the inequality is simple:
$$\operatorname{SSHA512}(\text{pw},\text{salt})=\operatorname{SHA512}(\text{pw}\parallel \text{salt})\parallel \text{salt}$$
So as you can see it's a case of a single iteration of SHA-512 paired with some basic salting. Salting is a good thing as it (among other things) thwarts rainbow-tables but of course a modern GPU (like the Tesla V100 or with nearly the same speed the RTX 2080 Ti) achieves about 1.8GH/s per card. That is $1.8\cdot 10^9$ SHA512 evaluations per second and per card. Also note that for about 25 USD/hr you can rent 8 of these on AWS which gives you about 2.1 TH/USD, that is an attacker can try about $2\ 000\ 000\ 000\ 000$ password hashes for a single US-Dollar. So if the user has any even remotely weak password, it's a matter of a few USD to break it.
The more modern approach is then to use Argon2 or bcrypt instead which perform much worse on GPUs.
