Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that a good password hashing algorithm should be slow. MD5, SHA256, etc. are fast. So I've been adding multiple iterations of SHA-256 hashing to my web apps (around 50000). Getting the hash of a password takes about 150ms on my machine.

Is there any advantage of bcrypt over this approach?

Note: I know about salts and pepper. Let's not talk about this here.

share|improve this question
3  
Have a look to this response: security.stackexchange.com/questions/2202/… TL;DR: "Dont roll your own crypto scheme, just don't !" –  Shadok Aug 26 '11 at 15:01
add comment

2 Answers

up vote 13 down vote accepted

Inserting the salt (yes, it must be talked about), and iterating the function at the same time, is a bit more tricky than what it usually appears. In particular, a hash function such as SHA-256 is not exactly a "random-oracle-like" function; it exhibits some internal structure. Any homemade construct could hit one of those fine details from which deadly weaknesses may emerge.

Making sure that you did it right is difficult, just like building any cryptographic algorithm. That's where bcrypt is better than any homemade construct: bcrypt has been published and in use and presumably inspected for flaws by many people over quite some time. This is basically the only hard measure of security that you can get in cryptography. The generic advice of "do not define your own algorithms" applies here too.

share|improve this answer
add comment

The problem you're facing have been already solved, and yes, you're going in the right direction: http://en.wikipedia.org/wiki/PBKDF2

share|improve this answer
1  
So is PBKDF2 a standardized way of doing what I'm doing with my own function? Or does it have other advantages? Maybe because of HMAC? (not sure I really understand what HMAC says). Thx! –  Philippe Gerber Jul 12 '11 at 9:29
3  
Yes, it's the standardized way. No, HMAC is different. –  Hubert Kario Jul 12 '11 at 9:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.