Are mkpasswd SHA512 hashes secure for the public?

Question

I am no crypto expert in any way so please bear with me if my question is kind of stupid.

We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I understood the concept, giving out your public key to the ... well ... "public" - is considered a safe thing to do since it can only be used to verify that you are really you. Creating content or authenticating yourself works against the private key which never leaves your machine, hence the strong security.

Now, given the above mentioned situation as a comparison, can it be considered secure if I created a password hash with the unix tool mkpasswd and a salted SHA512 hash and gave THAT out to the public?

My guess would be that it is not a smart idea to do, same as you would do with hashed passwords in a user database of a website. However, since this is only a guess I'd like some expert opinions.

Thanks!

Answer 1

The key difference here (no pun intended) is that the key includes a significant amount of entropy (i.e. it is random). Passwords are often quite terrible, commonly having under 30 bits of entropy. 30 bits is easily brute-forceable, so password hashes are designed to be slow (you specified salted SHA512, but you omitted the number of rounds), making the brute-force take longer. Despite this mitigation poor passwords will still be broken quickly.

Without a salt an attacker could use precomputation in the form of a rainbow table. That way, they could spend a bunch of time doing work so that when they do discover the hash value they can break it very quickly. The use of a (sufficiently long and random) salt prevents this, so that the attack can only begin the moment the hash is exposed.

So you are correct, this is a bad idea unless it is your password and you generated it with over 100 bits of entropy (in which case it's more like a key than a password).

It should also be noted that SHA-512 with the default of 5,000 rounds is not very good. It's not nearly as bad as a single round of MD5, but most computers nowadays can do over 2,000,000 rounds in under a second. You could expect a motivated attacker targeting a 5,000 round SHA-512 password to do millions to billions of guesses per second.

Answer 2

The key factor here turns out to be how difficult the password in question is to guess. If the password is weak—and most passwords by far are terrible—then giving out the hash gives the attacker a means to perform yes/no guesses on password guesses, and the cost of trying out lots of such guesses is much lower than that of finding a preimage for the hash (an input that produces the same output that was revealed).

With correctly generated private keys this isn't a concern because there are no efficient methods for guessing a private key. But note that with incorrectly generated private keys it's another story—there have been many incidents of buggy software that produces RSA keys that fit easy-to-guess patterns and therefore can be cracked.

Conversely, if a password is selected uniformly at random from a sufficiently large set, releasing a hash of it would be safe. For example, a 19-character uniform random printable ASCII password has about 126 bits of entropy—about as hard to guess as an AES-128 key.

Answer 3

First and foremost, you would have no way to authenticate yourself. If you send the hash, you proved nothing as everyone knows your hash. If you send plaintext password, the party now not only knows it, but other parties may not know you used it. So it is one-time use at best and completely insecure at worst.

---

As for the security of hashing a password, it can be secure if the password is long, generated randomly and hashed with a strong hash function. But for human created passwords, dictionary attacks would make it questionably secure even for good long passwords like correct horse battery staple.

There are actual applications that outright rely on the content not being retrievable from the hash other than password protection. A notable use is a secure coin flip. Therefore, it was presumably studied and determined safe for random passwords/keys.