OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too long!!!) on sec.SE about password hashing over last few months and it would be a sin not to try and prove it to my colleagues and seniors that MD5 and SHA are not suitable for password hashing.
I thought it would be good idea to come up with a PoC (demo databases containing passwords hashed with MD5, SHA 256 and bcrypt and attempting to measure the time taken to generate the hash) accompanied by some standard references.The points that I am willing to make are:
- Using SHA 256 over MD5 for password hashing does not improve security
- A Password hashing algorithm (bcrypt, PBKDF2) would be a much better choice for storing passwords, of course with unique salts.
- Some standard references to support these views.
p.s. I have programming experience but I am a novice when it comes to hardware based password cracking. It's not a "give me teh code" question; I am only asking for ideas and suggestions to make this a better PoC.