Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
How to securely hash passwords?
Do any security experts recommend bcrypt for password storage?

What would you choose between:

  • PBKDF2 SHA256 (270,000 iterations)
  • bcrypt (12, 13 or 14 cost: 1-2 seconds)
  • scrypt: I don't know if my hosting will allow it

I have to choose an algorithm to store passwords in a MySQL DB.

I've just read that bcrypt isn't so secure, PBKDF2 is more tested (but it could be reasonably faster on GPU/FPGA), scrypt is too new (and not tested enough) but is almost unbreakable.

So, please give me advice (in regards a sensible data website) and explain me what is better and why.

share|improve this question

marked as duplicate by Thomas Pornin, Jeff Ferland Sep 7 '12 at 16:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

What are your security requirements? Why are you using a hash algorithm? –  GdD Sep 7 '12 at 16:01
@GdD ops, sorry.. I forgot it! –  Surfer on the fall Sep 7 '12 at 16:03
A work factor that leads to 1 sec verification time opens you up to trivial DoS attacks. –  CodesInChaos Sep 7 '12 at 16:48
@CodesInChaos and if I set up sleep function based on requests made? –  Surfer on the fall Sep 7 '12 at 18:06

Browse other questions tagged or ask your own question.