Encoded output through sha512 algorithm does not started with $6 - java-8

Question

public static String sha(String base) {
try{
MessageDigest digest = MessageDigest.getInstance("SHA-512");
byte[] hash = digest.digest(base.getBytes("UTF-8"));
StringBuffer hexString = new StringBuffer();
for (int i = 0; i < hash.length; i++) {
String hex = Integer.toHexString(0xff & hash[i]);
if(hex.length() == 1) hexString.append('0');
hexString.append(hex);
}
return hexString.toString();
} catch(Exception ex){
throw new RuntimeException(ex);
}
}
the method above generate a string which is not started by $6.
i.e :
"0000" --> c6001d5b2ac3df314204a8f9d7a00e1503c9aba0fd4538645de4bf4cc7e2555cfe9ff9d0236bf327ed3e907849a98df4d330c4bea551017d465b4c1d9b80bcb0
However , we know that the first 2 or 3 chars indicates the hashing algorithm .
ie :
Blowfish --> $2$ or $2a$
SHA-512 --> $6$
- Is there a difference between encoding and hashing ?
or what is the story ?
UPDATE :
Linux crypt command line generates a string with 86 chars, however Java8 generates 128 chars .
#man 3 crypt
MD5 | 22 characters
SHA-256 | 43 characters
SHA-512 | 86 characters

Answer 1

It’s not clear why you expect a Java API function to produce the output of a GNU extension of a POSIX API function. Besides that, as you are generating the string in the Java code, you are the one who controls the size of the generated string.
The byte array returned by digest of SHA-512 has exactly 66 bytes which shouldn’t come to surprise as 66 (bytes) * 8 == 512 (bits). This is what an SHA-512 hash is all about. It was your decision to encode it in hexadecimal form, which needs one character for four bits, hence 512/4 == 128 characters.
By the way, even for that functionality, it’s worth getting used to the existing APIs, Java programming language features and coding conventions:
public static String sha(String base) {
try {
MessageDigest digest = MessageDigest.getInstance("SHA-512");
StringBuilder hexString = new StringBuilder();
for(byte b: digest.digest(base.getBytes(StandardCharsets.UTF_8)))
hexString.append(String.format("%02x", b&0xff));
return hexString.toString();
} catch(NoSuchAlgorithmException ex){
throw new RuntimeException(ex);
}
}
However, if the crypt C function generates 86 bytes, it’s most likely using the Base64 encoding, which needs one character for six bits, as 512 / 6 == 85,33…, thus at least 86 chars.
If you want to encode using base64, you can use a standard API starting with Java 8, for older versions you need either a 3rd party library or implement it yourself.
public static String sha(String base) {
try{
MessageDigest digest = MessageDigest.getInstance("SHA-512");
byte[] hash = digest.digest(base.getBytes(StandardCharsets.UTF_8));
return Base64.getEncoder().encodeToString(hash);
} catch(NoSuchAlgorithmException ex){
throw new RuntimeException(ex);
}
}
Note that the encoded string will have 88 characters as the standard base64 format has a padding, i.e. there will be always two = characters at the end here. If you know from context (like with SHA-512), that it has to be 512 bits, you can omit them when storing the result:
public static String sha(String base) {
try{
MessageDigest digest = MessageDigest.getInstance("SHA-512");
byte[] hash = digest.digest(base.getBytes(StandardCharsets.UTF_8));
String encoded = Base64.getEncoder().encodeToString(hash);
assert encoded.length()==88 && encoded.endsWith("==");
return encoded.substring(0, 86);
} catch(NoSuchAlgorithmException ex){
throw new RuntimeException(ex);
}
}

Answer 2

crypt(3) is a password hashing algorithm that is only based on SHA-512.
You can find a Java implementation in the Apache Commons Codec project:
https://commons.apache.org/proper/commons-codec/apidocs/org/apache/commons/codec/digest/Crypt.html
https://commons.apache.org/proper/commons-codec/apidocs/org/apache/commons/codec/digest/Sha2Crypt.html
The algorithm actually feeds the result of the first SHA-512 digest to it self several thousand times to be deliberately slow as this makes bruteforce cracking the password harder.