Assuming I'm working on an environment that currently uses MD5 to hash passwords, and I want to switch to something more secure.
I already heard of bcrypt, but I had another idea.
Would it be possible to use RSA2048 to hash passwords if I just threw away the private key of the key pair?
If so, is that less secure then using a dedicated hashing algorhitm like for instance bcrypt? (Assuming you use salt/pepper in both cases in addition):
I have following process in mind:
Every password gets its own public RSA2048 key, the private keys are discarded.
MD5 Hash the password
- Encrypt the MD5 Hash using RSA2048 with that password's specific RSA2048 public key
- Pepper the result with pepper of fixed lenght
Is this a secure password hashing scheme? On the same level as running a password through bcrypt or scrypt?