Ok I am currently storing the passwords in most secure way I could think of. With use of Encryption and Hash. The passwords are first generated by user as plain-text with minimum length of 6 alpha-numeric characters up-to 24 char alpha-numeric.
After the passwords plain-text value are ran against MCRYPT. Primarily the TWO_FISH cipher with random IV in ECB mode. Ones that is done the Encrypted plain-text is binded to Hash function which also add's SALT via
$saltVar = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647));
One's everything is in place the SALT + Encrypted password are hashed via SHA-256 and then re-hashed next 15536 rounds. Creating a relatively secure password.
In my personal opinion this is sufficient way of securing the data, since in part there are no key's being used there is no way of decrypting this, other then running it again with user inputed plain-text password and creating a temporary calculated hash of the password string, after which the string can be matched to the string in the database.
I would never use this for any other data, but for password I belive this is sufficient. However I would still like some profesional critisism, as to whatever my way of protecting the password plain-text is secure or not, and or maybe how I can improve what I already have if its just fine. And while I am at it, would you recomand using TWO_FISH or swapping it for SEARPENT?
Thanks in advance.