I was wondering why PHP's hash_password function use blowfish instead of threefish. According to Bruce Schneier blowfish is outdated and He is recommending twofish or threefish. Is blowfish enough secure and threefish just slow the login authentication down?
PHP uses bcrypt for
password_hash(), but since PHP is PHP, they have to maximize confusion, so they call it "Blowfish".
Besides being a family of highly poisonous fish, Blowfish is a block cipher for more than 20 years ago. Bcrypt is a password hashing function that happens to be derived from an internal block cipher which is similar to Blowfish -- but it is used for something completely different from what block cipher are meant to be used for, i.e. encryption.
Threefish is another block cipher, which was designed much later on for yet another purpose, which is the design of the Skein hash function. Now pay attention, for here comes the tricky point. "Hash functions" and "password hashing functions" are completely different things. Despite the similarity in name, they are very distinct beasts, that take different kinds of inputs, produce different kinds of outputs, and have very different security requirements and properties.
Threefish was designed as a block cipher for a variety of reasons, the primary of which being the need for large blocks (512 bits or more), because you need large blocks to make a hash function that resists collisions. However, collisions are completely irrelevant to password hashing, and the short block size of Blowfish (64 bits) is not a problem for bcrypt.
As block ciphers, Threefish is "better" than Blowfish in a lot of ways (bigger blocks, faster, can be implemented without tables...). As a building block for a hash function, Threefish is again better than Blowfish, but in different ways. As a building block for a password hashing function, Threefish is actually worse than Blowfish, for about the same reasons that Threefish is better than Blowfish for a hash function; in particular, Threefish can be implemented without tables. This means that Threefish allows for thoroughly optimized parallel implementations on GPU, something which is good in general, and very bad for password hashing.
None of this really explains why PHP has not "switched to Threefish". This just tells why such a switch would be a bad idea.
While you don't give a link for Schneier's (not corrected spelling) comment, I suspect that he was talking about the blowfish encryption algorithm. While bcrypt is based on blowfish, it is not considered to have similar weaknesses.
password_hash is designed to be compatible with
crypt(), which supports a limited range of hash algorithms. Of the supported algorithms, Blowfish is the only cryptographic algorithm:
- DES is known to be weak, and has a very short hash (2 character)
- Extended DES is little better
- MD5 is far too fast to use for password hashing - it is possible to make 100ks of trials per second on a modern PC
- SHA256 and SHA512 are both strong, but still faster than Blowfish, which is a bad thing for passwords. They do support a round count, which helps, and could theoretically be used
Any other function could easily be included in PHP, but would result in hashes that couldn't be verified using crypt.