title: PBKDF2WithHmacSHA512 Vs. PBKDF2WithHmacSHA1
body: <p>I'm working on a Java authentication subsystem that specs the storage of passwords in the DB as <code>PBKDF2</code>-generated hashes, and I'm now trying to decide whether I should use <code>SHA1</code> or <code>SHA512</code> as PRF. I went through the specs of both but they are very mathematically intensive for me to follow. Can somebody with better crypto-understanding explain how <code>PBKDF2WithHmacSHA512</code> differs from <code>PBKDF2WithHmacSHA1</code>?</p>
  
  <p>Here's what I'm trying to do:</p>
  
  <pre class="lang-java prettyprint-override"><code>private static final int HASH_BYTE_SIZE = 64 * 8; // 512 bits
  private static final int PBKDF2_ITERATIONS = 1000;      
  
  // generate random salt
  SecureRandom random = new SecureRandom();
  byte salt[] = new byte[SALT_BYTE_SIZE]; // use salt size at least as long as hash
  random.nextBytes(salt);
  
  // generate Hash
  PBEKeySpec spec = new PBEKeySpec(password, salt, PBKDF2_ITERATIONS, HASH_BYTE_SIZE);
  SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1"); // we would like this to be "PBKDF2WithHmacSHA512" instead? What Provider implements it?
  byte[] hash = skf.generateSecret(spec).getEncoded();
  
  // convert hash and salt to hex and store in DB as CHAR(64)...
  </code></pre>