mjhjmtu

I am using SSHA512 to encrypt email user's passwords. Manually doing this works using doveadm from dovecot. But I can't seem to implement this in my mail client. I can, however, use SHA512.

Is SHA512 less secure than SSHA512?

Is SHA512 less secure than SSHA512?

Hashing passwords plainly with SHA512 is indeed less secure than using SSHA512. But note that this doesn't imply that using SSHA512 is actually a good / secure method for hashing your passwords.

The reason for the inequality is simple:

$$operatornameSSHA512(textpw,textsalt)=operatornameSHA512(textpwparallel textsalt)parallel textsalt$$

So as you can see it's a case of a single iteration of SHA-512 paired with some basic salting. Salting is a good thing as it (among other things) thwarts rainbow-tables but of course a modern GPU (like the Tesla V100 or with nearly the same speed the RTX 2080 Ti) achieves about 1.8GH/s per card. That is $1.8cdot 10^9$ SHA512 evaluations per second and per card. Also note that for about 25 USD/hr you can rent 8 of these on AWS which gives you about 2.1 TH/USD, that is an attacker can try about $2 000 000 000 000$ password hashes for a single US-Dollar. So if the user has any even remotely weak password, it's a matter of a few USD to break it.

The more modern approach is then to use Argon2 or bcrypt instead which perform much worse on GPUs.