Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How to securely hash passwords?
Do any security experts recommend bcrypt for password storage?

What would you choose between:

  • PBKDF2 SHA256 (270,000 iterations)
  • bcrypt (12, 13 or 14 cost: 1-2 seconds)
  • scrypt: I don't know if my hosting will allow it

I have to choose an algorithm to store passwords in a MySQL DB.

I've just read that bcrypt isn't so secure, PBKDF2 is more tested (but it could be reasonably faster on GPU/FPGA), scrypt is too new (and not tested enough) but is almost unbreakable.

So, please give me advice (in regards a sensible data website) and explain me what is better and why.

share|improve this question

marked as duplicate by Thomas Pornin, Jeff Ferland Sep 7 '12 at 16:55

This question was marked as an exact duplicate of an existing question.

    
What are your security requirements? Why are you using a hash algorithm? – GdD Sep 7 '12 at 16:01
    
@GdD ops, sorry.. I forgot it! – Surfer on the fall Sep 7 '12 at 16:03
    
A work factor that leads to 1 sec verification time opens you up to trivial DoS attacks. – CodesInChaos Sep 7 '12 at 16:48
    
@CodesInChaos and if I set up sleep function based on requests made? – Surfer on the fall Sep 7 '12 at 18:06