Home > Advanced Linux-related things, Linux, Security > Implementation of SHA512-crypt vs MD5-crypt

Implementation of SHA512-crypt vs MD5-crypt

August 16th, 2011

If you have a new installation, you’re probably using SHA512-based passwords instead of the older MD5-based passwords described in detail in the previous post, which I’ll assume you’ve read. sha512-crypt is very similar to md5-crypt, but with some interesting differences.

Since the implementation of sha512 is really less interesting than the comparison with md5-crypt, I’ll describe it by striking out the relevant parts of the md5-crypt description and writing in what sha512-crypt does instead.

Like md5-crypt, it can be divided into three phases. Initialization, loop, and finalization.

  1. Generate a simple md5 sha512 hash based on the salt and password
  2. Loop 1000 5000 times, calculating a new sha512 hash based on the previous hash concatenated with alternatingly the hash of the password and the salt. Additionally, sha512-crypt allows you to specify a custom number of rounds, from 1000 to 999999999
  3. Use a special base64 encoding on the final hash to create the password hash string

 

The main differences are the higher number of rounds, which can be user selected for better (or worse) security, the use of the hashed password and salt in each round, rather than the unhashed ones, and a few tweaks of the initialization step.

 

Here’s the real sha512-crypt initialization.

  1. Let “password” be the user’s ascii password, “salt” the ascii salt (truncated to 8 16 chars) , and “magic” the string “$1$”
  2. Start by computing the Alternate sum, sha512(password + salt + password)
  3. Compute the Intermediate0 sum by hashing the concatenation of the following strings:
    1. Password
    2. Magic
    3. Salt
    4. length(password) bytes of the Alternate sum, repeated as necessary
    5. For each bit in length(password), from low to high and stopping after the most significant set bit
      • If the bit is set, append a NUL byte the Alternate sum
      • If it’s unset, append the first byte of the password
  4. New: Let S_factor be 16 + the first byte of Intermediate0
  5. New: Compute the S bytes, length(salt) bytes of sha512(salt, concatenated S_factor times).
  6. New: Compute the P bytes, length(password) bytes of sha512(password), repeated as necessary

 

Step 3.5 — which was very strange in md5-crypt — now makes a little more sense. We also calculated the S bytes and P bytes, which from here on will be used just like salt and password was in md5-crypt.

From this point on, the calculations will only involve the password P bytes, salt S bytes, and the Intermediate0 sum. Now we loop 5000 times (by default), to stretch the algorithm.

  • For i = 0 to 4999 (inclusive), compute Intermediatei+1 by concatenating and hashing the following:
    1. If i is even, Intermediatei
    2. If i is odd, password P bytes
    3. If i is not divisible by 3, salt S bytes
    4. If i is not divisible by 7, password P bytes
    5. If i is even, password P bytes
    6. If i is odd, Intermediatei

    At this point you don’t need Intermediatei anymore.

You will now have ended up with Intermediate5000. Let’s call this the Final sum. Since sha512 is 512bit, this is 64 bytes long.

The bytes will be rearranged, and then encoded as 86 ascii characters using the same base64 encoding as md5-crypt.

  1. Output the magic, “$6$”
  2. New: If using a custom number of rounds, output “rounds=12345$”
  3. Output the salt
  4. Output a “$” to separate the salt from the encrypted section
  5. Pick out the 64 bytes in this order: 63 62 20 41 40 61 19 18 39 60 59 17 38 37 58 16 15 36 57 56 14 35 34 55 13 12 33 54 53 11 32 31 52 10 9 30 51 50 8 29 28 49 7 6 27 48 47 5 26 25 46 4 3 24 45 44 2 23 22 43 1 0 21 42
    • For each group of 6 bits (there’s 86 groups), starting with the least significant
      • Output the corresponding base64 character with this index

 

And yes, I do have a shell script for this as well: sha512crypt. This one takes about a minute to generate a hash, due to the higher number of rounds. However, it doesn’t support custom rounds.

I hope these two posts have provided an interesting look at two exceedingly common, but often overlooked, algorithms!

Advanced Linux-related things, Linux, Security , , ,

  1. Brian
    May 23rd, 2012 at 10:01 | #1

    Thanks for both of the encryption posts, which have helped me greatly.

  2. Vidar
    May 23rd, 2012 at 10:08 | #2

    @Brian
    Glad you found them useful!

  3. Arun
    April 16th, 2013 at 10:33 | #3

    I used mkpasswd to generate a sha-512 hash. my password is albie and salt is manchester.

    I got,
    $6$manchester$TwoSPqHW6mknKw92/bgOGuoGaRVEwllGUwufok/ZQ/YBmr0R/At92RrJlktlrgBDgQ0WE1jMpuzMNY2XbZt9u0

    but when I ran the script, I got,

    $6$manchester$P8EhrUkm2e7bQDaf/8cTJOANQjapUqDZspwhtfnqOnih0rJVntslKNvEA0G7sWQOlpBaiPOelA4p99CLJaVCT0

    can you tell why I’m getting different hashed output?

  4. Vidar
    April 16th, 2013 at 17:14 | #4

    That’s odd, I get identical outputs. What kind of system are you running this on?

  5. Arun
    April 17th, 2013 at 08:22 | #5

    I’m running it on ubuntu 12.04. Os type : 64 bit.

  6. Vidar
    April 18th, 2013 at 03:21 | #6

    Strange. Me too. Could you verify that the md5sum of the script is c8ca45e36c3b43ce3fcd9f2657db7c9f? Are you running ‘bash sha512crypt.bash’?

  7. Arun
    April 18th, 2013 at 07:57 | #7

    I’m getting similar output for md5crypt. but not for sha512 crypt. Is there any change in number of rounds(here 5000 as mentioned)?

  8. Totyz
    May 30th, 2014 at 23:09 | #8

    thank you for these explanations

  1. February 16th, 2013 at 17:42 | #1

Ignore the following captcha and enter 'bunnies' in the field instead.