PBKDF2WithHmacSHA512 Vs. PBKDF2WithHmacSHA1

Question

I'm working on a Java authentication subsystem that specs the storage of passwords in the DB as PBKDF2-generated hashes, and I'm now trying to decide whether I should use SHA1 or SHA512 as PRF. I went through the specs of both but they are very mathematically intensive for me to follow. Can somebody with better crypto-understanding explain how PBKDF2WithHmacSHA512 differs from PBKDF2WithHmacSHA1?

Here's what I'm trying to do:

private static final int HASH_BYTE_SIZE = 64 * 8; // 512 bits
private static final int PBKDF2_ITERATIONS = 1000;      

// generate random salt
SecureRandom random = new SecureRandom();
byte salt[] = new byte[SALT_BYTE_SIZE]; // use salt size at least as long as hash
random.nextBytes(salt);

// generate Hash
PBEKeySpec spec = new PBEKeySpec(password, salt, PBKDF2_ITERATIONS, HASH_BYTE_SIZE);
SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1"); // we would like this to be "PBKDF2WithHmacSHA512" instead? What Provider implements it?
byte[] hash = skf.generateSecret(spec).getEncoded();

// convert hash and salt to hex and store in DB as CHAR(64)...

Simonette

For those who will use this code: Please note that PBEKeySpec is expecting hash byte length in bits and not bytes so HASH_BYTE_SIZE should be 64 * 8 or rename it to HASH_BITS_SIZE = 512 otherwise you will receive only 8 bytes of hash. – Bipetalous

Answer 1

Let us breakdown the word piece by piece:

PBKDF2--WithHmac--SHA512

Let's go over it part by part

• PBKDF2

  Stands for Password-based-Key-Derivative-Function, a successor of PBKDF1 and is used to implement a pseudorandom function, such as a cryptographic hash, cipher, or HMAC to the input password or passphrase along with a salt value and repeats the process many times to produce a derived key, which can then be used as a cryptographic key in subsequent operations.

• HMAC

  Stands for Keyed-Hash Message Authentication Code (HMAC) is a specific construction for calculating a message authentication code (MAC) involving a cryptographic hash function in combination with a secret cryptographic key. Any cryptographic hash function,may be used in the calculation of an HMAC; the resulting MAC algorithm is termed HMAC-MD5 or HMAC-SHA1 accordingly.

• SHA512

  Well, you know about it.. :P

Now, coming back to your question, the line of code:

SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");

specifies the keyFactory to use the algorithm PDBKDF2WithHmacSHA1. When you would do something like:

SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA512");

you tell the factory to use algorithm PBDKF2WithHmacSHA512.

Essentialy the main difference between PBKDF2WithHmacSHA1 and PBKDF2WithHmacSHA512 is that:

1. The PBKDF2WithHmacSHA1 will produce a hash length of 160 bits.
2. The PBKDF2WithHmacSHA512 will produce a hash length of 512 bits.

Hence the latter is more secure. But there are arguments on both sides as to which is sufficient for encryption. No debate. Just saying.

Some additional information about the two algorithms:

1. HMACSHA1

   HMACSHA1 is a type of keyed hash algorithm that is constructed from the SHA1 hash function and used as an HMAC, or hash-based message authentication code. The HMAC process mixes a secret key with the message data, hashes the result with the hash function, mixes that hash value with the secret key again, and then applies the hash function a second time. The output hash is 160 bits in length.

2. HMACSHA512

   HMACSHA512 is a type of keyed hash algorithm that is constructed from the SHA-512 hash function and used as a Hash-based Message Authentication Code (HMAC). The HMAC process mixes a secret key with the message data and hashes the result. The hash value is mixed with the secret key again, and then hashed a second time. The output hash is 512 bits in length.

The main advantage is that HmacWith512 is more secure than HmacWith256. For e.g.

HMAC_SHA1("key","The quick brown fox jumps over the lazy dog") = 0xde7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9

HMAC_SHA512("key","The quick brown fox jumps over the lazy dog") = 0xb42af09057bac1e2d41708e48a902e09b5ff7f12ab428a4fe86653c73dd248fb82f948a549f7b791a5b41915ee4d1ec3935357e4e2317250d0372afa2ebeeb3a

The difference is pretty huge (as seen). Hope it helps. :)

EDIT: As OP mentions

PBEKeySpec(char[] password, byte[] salt, int iterationCount, int keyLength)

The parameter keyLength is used to indicate the preference on key length for variable-key-size ciphers. The actual key size depends on each provider's implementation. Hence say, doing something like

PBEKeySpec(password, salt, int 100, 512) doesn't mean you will be using SHA1 to generate a keyLength of 512. It simply means that. SHA1 supports upto a maximum of 160 bits. You cannot exceed that.

As for your second question, have a look at the HMAC-SHA1. There are many statements that say algorithms like SHA256 is pretty good if you a long hash.

Also, as per the NSA :

The NSA specifies that "Elliptic Curve Public Key Cryptography using the 256-bit prime modulus elliptic curve as specified in FIPS-186-2 and SHA-256 are appropriate for protecting classified information up to the SECRET level. Use of the 384-bit prime modulus elliptic curve and SHA-384 are necessary for the protection of TOP SECRET information.

I think using a HMAC function in conjunction SHA512 is quite secure.

Legra

You mention that the main difference between PDBKDF2WithHmacSHA1 and PDBKDF2WithHmacSHA512 is that they produce different hash length (160bits vs. 512bits respectively). However I don't think this is correct because the keyLength argument in PBEKeySpec(char[] password, byte[] salt, int iterationCount, int keyLength) governs the length of the hash produced. If I run this specifying 512, 256, and 160, I get respective hashes of different lengths. – Simonette

"there are arguments on both sides as to which is sufficient for encryption". Any links would be appreciated, I'd like to read up on it. I can find comparisons between SHA1 vs. SHA512, but none between PDBKDF2WithHmacSHA1 and PBKDF2WithHmacSHA512. Btw, I've tried doing SecretKeyFactory.getInstance("PBKDF2WithHmacSHA512"); originally, but it throws a NoSuchAlgorithmException. Not included in javax.crypto? I would like to use it but I can't find a Provider offering it, apart from IAIK (they charge a few thousand $ for their JCE library, oopss..). Anybody aware of other options? – Simonette

You make an implication that the larger length of produced hash is an indicator of a "more secure" hashing method. Without providing any comments regarding the effects of hash length for a particular type of attack, saying things like that is rather speculative. For instance, if the hashed value (e.g. a password) is know to be short enough, say 8 characters, it makes no real difference how large the output of a hashing method is, as long as it can be computed fast enough, a brute-force attack is still feasible. – Reset

@Simonette In PDBKDF2, the output key is a concatenation of "blocks" which is generated independently and with length determined by the HMAC, which is in turn determined by the underlying hash. Hence, for cracking PBKDF2-generated password hashes, only the first block is required. e.g. for hashing password with PBKDF2/HMAC/SHA1, a 160-bit output has the same level of security as a 1024-bit output. – Magpie

Such a large output is not required. Argon2i which currently is the state-of-the-art recommended password hashing function has a 256 bit output and when used for password hashing, it is commonly truncated to 128 bit. See here for a detailed discussion: crypto.stackexchange.com/questions/39249/… – Rafaellle

Is the NSA quote really relevant? It seems to me that statement focuses on ECC strength in combination with SHA-* hashing, which might not be relevant to assessing the SHAs security in isolation. – Rabi

Answer 2

SHA512 belongs to the SHA2 family of cryptographic hash functions. Since SHA1 has theoretical weaknesses and SHA512 is slightly slower than SHA1 (slower is better when hashing passwords), SHA512 (or any of the SHA2 family) should be chosen over SHA1 for the purpose of hashing passwords.

Actually understanding the differences in the functions is not going to be simple, but you might have a better chance of getting an answer on the Crypto SE site.

Honeysuckle

Right, speed (or lack of) is critical. But PBKDF2 includes a tunable work factor. Hence, the relative speed of SHA512 vs SHA1 is irrelevant. – Rafaellle