First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here.

According to the [early] doc pages of the new PHP 5.5 password hashing/encrypting API the used algorithm CRYPT_BLOWFISH is "strongest algorithm currently supported by PHP" (please do a full text search to find the quote on the page).

My question is: Can this be proven with some numbers, benchmarks etc. ?

According to the PHP's crypt() doc page CRYPT_BLOWFISH uses 22 char salt and generates a 60 char hash, and CRYPT_SHA512 uses a 16 char salt and generates a 118 char hash. Both algorithms have changeable cost factors, so at first view, SHA512 looks stronger (because longer).

  • 4
    Just a hunch: sha is designed to be fast, as it's for message integrity validation. Blowfish is designed to be slow, that's why it's awesome for passwords.
    – Maerlyn
    May 25, 2013 at 19:54
  • -1 You have already received some good and satisfying answers at Stackoverflow. No need to cross-post.
    – Adi
    May 25, 2013 at 20:08
  • 3
    @Adnan it was closed as off-topic there and it would be good to have other looking for this security-related information to be able to find it on our site.
    – Jeff Ferland
    May 25, 2013 at 20:34
  • 2
    @Adnan The answers on SO are rather weak and since it's closed nobody can post a better one. May 25, 2013 at 22:20
  • 2
    Designed to be slow on highly parallel hardware, such as GPUs. Your test is only as relevant as the chance an attacker will use same or similar hardware you were to brute-force password hashes. By that account, it would take the time in your results to try a single possible input value. Clearly unfeasible, so the attacker would somehow try parallelizing this process. GPUs are an obvious choice, but (at least current hardware) fails being much faster with BLOWFISH because of large internal RAM table it uses. See this answer for more info.
    – TildalWave
    May 25, 2013 at 22:55

2 Answers 2

  • we're talking about strongest for password hashing here. A good general purpose hash doesn't need to be a good password hash, and vice versa.
  • Length of the hash is irrelevant once it exceeds a certain threshold. A pre-image attack on an n bit hash costs 2n. For a 128 bit hash this is completely infeasible.
  • bcrypt using an exponential notation for cost and sha512-crypt using a linear notation is irrelevant. Comparing their CPU cost with default parameters is meaningless as well.

    In practice you choose a time budget, say 10ms. Then you adjust the cost factor of the hash to match that budget. So if an attacker used the same hardware as the defender, then all decent password hashes would be the same.

  • An attacker uses different hardware from the defender. The defender uses a standard CPU. The attacker uses at least a GPU, or if it's an advanced attacker perhaps an FPGA or ASIC.

    The difference between different hashes is how well they run on different kinds of hardware. BCrypt needs a few kilobytes of really fast memory. This works well with common CPUs, but doesn't work well with GPUs. So bcrypt is very GPU unfriendly. With FPGA the advantage of bcrypt is smaller, especially if it has integrated RAM. But it's still a bit better.

  • A a simple benchmark you could tune the candidate hashes to the same cost. Then run a GPU based password cracker, such as hashcat or john-the-ripper and check its performance. I expect bcrypt to have a much lower hashrate.
  • There is also another interesting password scheme called scrypt. It uses larger amounts of memory and if your time budget is large it's significantly better than bcrypt or SHA512-crypt.

The "mathematical proof" is you can choose N arbitrarily:

t(bcrypt) * (2^N) >> t(sha)

The final hash is all about avoiding collisions, so you're safe so long as

hash >> password

The salt is all about avoiding rainbow tables, so you're safe so long as

(rainbow table size) * (salt) >> (attacker storage space)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .