Take the 2-minute tour ×


I need to not do this:

var hash = sha512(salt + password); 
    hash = sha512(hash); 

And instead, need to do this:

var hash = sha512(salt + password); 
    hash = sha512(salt + hash); 


share|improve this question
Who says it is better? I’m not saying it isn’t, but maybe the context contains some argument? –  Christopher Creutzig Jan 8 at 19:35
Can you provide a reference that says that you should prefer the second to the first? –  templatetypedef Jan 8 at 21:18
I personally don't think it matters (although I would probably use the second because why not) but maybe post in crypto.stackexchange instead. –  Jeff Jan 8 at 22:53
This question is borderline since it is more about the security of the cryptographic algorithm than about its implementation. In any case, it has been reposted on Cryptography. –  Gilles Jan 8 at 23:26

1 Answer 1

It is not that you simply need to do "hash = sha512(salt + hash)" - it's more complex than that. An HMAC is a better way of adding your salt (and PBKDF2 is based on HMAC - see below for more detail on PBKDF2) - there's a good discussion at When is it safe to use a broken hash function? for those details.

You are correct in that you need to have multiple iterations of a hash function for security.

However, don't roll your own. See How to securely hash passwords?, and note that PBKDF2, BCrypt, and Scrypt are all means of doing so.

PBKDF2, also known as PKCS#5v2 and RFC2898 is in fact reasonably close to what you're doing (multiple iterations of a normal hash function), particular in the form of PBKDF2-HMAC-SHA-512, in particular section 5.2 lists:

     For each block of the derived key apply the function F defined
     below to the password P, the salt S, the iteration count c, and
     the block index to compute the block:


     where the function F is defined as the exclusive-or sum of the
     first c iterates of the underlying pseudorandom function PRF
     applied to the password P and the concatenation of the salt S
     and the block index i:

             F (P, S, c, i) = U_1 \xor U_2 \xor ... \xor U_c


               U_1 = PRF (P, S || INT (i)) ,
               U_2 = PRF (P, U_1) ,
               U_c = PRF (P, U_{c-1}) .

     Here, INT (i) is a four-octet encoding of the integer i, most
     significant octet first.

P.S. SHA-512 was a good choice of hash primitive - SHA-512 (and SHA-384) are also superior to MD5, SHA-1, and even SHA-224 and SHA-256 because SHA-384 and up use 64-bit operations which current GPU's (early 2014) do not have as much of an advantage over current CPU's with as they do 32-bit operations, thus reducing the margin of superiority attackers have for offline attacks.

share|improve this answer
Sure what you write is true, but the question was very specific about adding the salt in each iteration. The question was reposted on crypto.stackexchange.com, have a look at the answers there. –  martinstoeckli Feb 26 at 8:10

Your Answer


