2

I was wondering why PHP's hash_password function use blowfish instead of threefish. According to Bruce Schneier blowfish is outdated and He is recommending twofish or threefish. Is blowfish enough secure and threefish just slow the login authentication down?

11

PHP uses bcrypt for password_hash(), but since PHP is PHP, they have to maximize confusion, so they call it "Blowfish".

Besides being a family of highly poisonous fish, Blowfish is a block cipher for more than 20 years ago. Bcrypt is a password hashing function that happens to be derived from an internal block cipher which is similar to Blowfish -- but it is used for something completely different from what block cipher are meant to be used for, i.e. encryption.

Threefish is another block cipher, which was designed much later on for yet another purpose, which is the design of the Skein hash function. Now pay attention, for here comes the tricky point. "Hash functions" and "password hashing functions" are completely different things. Despite the similarity in name, they are very distinct beasts, that take different kinds of inputs, produce different kinds of outputs, and have very different security requirements and properties.

Threefish was designed as a block cipher for a variety of reasons, the primary of which being the need for large blocks (512 bits or more), because you need large blocks to make a hash function that resists collisions. However, collisions are completely irrelevant to password hashing, and the short block size of Blowfish (64 bits) is not a problem for bcrypt.

As block ciphers, Threefish is "better" than Blowfish in a lot of ways (bigger blocks, faster, can be implemented without tables...). As a building block for a hash function, Threefish is again better than Blowfish, but in different ways. As a building block for a password hashing function, Threefish is actually worse than Blowfish, for about the same reasons that Threefish is better than Blowfish for a hash function; in particular, Threefish can be implemented without tables. This means that Threefish allows for thoroughly optimized parallel implementations on GPU, something which is good in general, and very bad for password hashing.


None of this really explains why PHP has not "switched to Threefish". This just tells why such a switch would be a bad idea.

2
  • 1
    You are too quick to blame PHP for the "naming confusion" here; the CRYPT_BLOWFISH constant takes its name from the library used, called crypt_blowfish. This is a reimplementation which originated in a password cracking tool of the "blowfish-based crypt() scheme" called bcrypt. It's not clear why it's named how it is, but it's certainly nothing to do with PHP.
    – IMSoP
    Jan 11 '16 at 22:37
  • The name that PHP uses inside of password_hash is bcrypt: php.net/password_hash so...
    – ircmaxell
    Jan 12 '16 at 13:11
3

PHP's password_hash uses the bcrypt hashing function. This is close to state-of-the-art for password storage with perhaps scrypt lined up as its successor.

While you don't give a link for Schneier's (not corrected spelling) comment, I suspect that he was talking about the blowfish encryption algorithm. While bcrypt is based on blowfish, it is not considered to have similar weaknesses.

4
  • 1
    Agron2i will likely be the next successor to bcrypt, and is being worked on for 7.1
    – ircmaxell
    Jan 12 '16 at 13:13
  • @ircmaxell, do you have a reference? I couldn't find one. And 7.1 what? Jan 12 '16 at 13:23
  • 7.1 would be the next minor version if PHP to be released. Reference - mailing list thread
    – ircmaxell
    Jan 12 '16 at 13:25
  • Thx @ircmaxell. Jan 12 '16 at 13:33
0

Currently, password_hash is designed to be compatible with crypt(), which supports a limited range of hash algorithms. Of the supported algorithms, Blowfish is the only cryptographic algorithm:

  • DES is known to be weak, and has a very short hash (2 character)
  • Extended DES is little better
  • MD5 is far too fast to use for password hashing - it is possible to make 100ks of trials per second on a modern PC
  • SHA256 and SHA512 are both strong, but still faster than Blowfish, which is a bad thing for passwords. They do support a round count, which helps, and could theoretically be used

Any other function could easily be included in PHP, but would result in hashes that couldn't be verified using crypt.

1
  • I'm not sure I understand how your answer is responding to the OP. Jan 11 '16 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.