What are SHA-rounds?

Question

I understand more sha-rounds make it difficult to bruteforce the hashed password in /etc/shadow. Higher rounds also use more CPU processing when executing sudo commands and logging into the Unix account. But what are sha-rounds really? The chpasswd manual doesn't really give a technical definition of sha-rounds.

-s, --sha-rounds ROUNDS
           Use the specified number of rounds to encrypt the passwords.

           The value 0 means that the system will choose the default number of rounds for the crypt method (5000).

           A minimal value of 1000 and a maximal value of 999,999,999 will be enforced.

           You can only use this option with the SHA256 or SHA512 crypt method.

           By default, the number of rounds is defined by the SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS variables in /etc/login.defs.

The SHA-2 wiki doesn't really say either:

SHA-256 and SHA-512 ... use different shift amounts and additive constants, but their structures are otherwise virtually identical, differing only in the number of rounds.

In both the chpasswd manual and SHA-2 wiki, there isn't enough context to determine what "sha-rounds" are or how they relate to SHA512.

Answer 1

What the manual is referring to as rounds is probably better called iterations. While it is true that the SHA-2 function internally has a fixed number of rounds (64 or 80, depending on which hash is used), that is not what this manual is talking about. In order to make hashed passwords more secure, programs will often put the password through a KDF function such as PBKDF2, which runs a single hash function many times over to slow down brute force attacks. This is what "rounds" refers to in this context. The higher the round number, the longer it takes for a password to be processed and the more secure it is.

Answer 2

Secure systems don't store passwords directly, or even in encrypted form, but as salted, slow hashes. See How to securely hash passwords? for more details.

The goal of using a hashing mechanism rather than encryption is to make it impossible to go back from the password hash (what's stored in /etc/shadow) to the password itself, except with the “trivial” method of guessing a password, calculating the corresponding hash and comparing it with the database entry. The goal of making the hash calculation slow is to slow down such brute force attempts.

One common way of constructing a slow hash is to take an ordinary cryptographic hash function such as SHA-256 or SHA-512 and to run it many times: basically SHA-256(SHA-256(…(SHA-256(salt + password)))). (That's not the actual calculation, I'm just showing the relevant aspect here.) Because it's impossible to find x given SHA-256(x) short of guessing x itself and verifying the guess by calculating SHA-256(guess), it's impossible to find password given its iterating hash short of making a guess and verifying it. This is what most Unix systems use today, using a method sometimes called SHAcrypt (but it doesn't really have a commonly-used name). PBKDF2 is a better-known name; it's a very similar scheme, built upon the same principle of iterating a hash function multiple times but with a slightly different construction.

What the documentation of chpasswd calls “number of SHA rounds” is the number of times that the salted-iterated-SHA2 construction calls the hash function. This is more commonly called “number of iterations”.

Some cryptographic primitives including SHA-256 and SHA-512 are described as using multiple rounds internally, but this has nothing to do with the use of the word “rounds” in the documentation of chpasswd. SHAcrypt uses the standard hash function (SHA-256 or SHA-512) as a black box, and calls it multiple times.