13

I know that a good password hashing algorithm should be slow. MD5, SHA256, etc. are fast. So I've been adding multiple iterations of SHA-256 hashing to my web apps (around 50000). Getting the hash of a password takes about 150ms on my machine.

Is there any advantage of bcrypt over this approach?

Note: I know about salts and pepper. Let's not talk about this here.

Bill the Lizard
  • 6,731
  • 4
  • 19
  • 28
Philippe Gerber
  • 350
  • 2
  • 8
  • 3
    Have a look to this response: http://security.stackexchange.com/questions/2202/lessons-learned-and-misconceptions-regarding-encryption-and-cryptology/2210#2210 _TL;DR_: "Dont roll your own crypto scheme, just don't !" – Shadok Aug 26 '11 at 15:01

2 Answers2

14

Inserting the salt (yes, it must be talked about), and iterating the function at the same time, is a bit more tricky than what it usually appears. In particular, a hash function such as SHA-256 is not exactly a "random-oracle-like" function; it exhibits some internal structure. Any homemade construct could hit one of those fine details from which deadly weaknesses may emerge.

Making sure that you did it right is difficult, just like building any cryptographic algorithm. That's where bcrypt is better than any homemade construct: bcrypt has been published and in use and presumably inspected for flaws by many people over quite some time. This is basically the only hard measure of security that you can get in cryptography. The generic advice of "do not define your own algorithms" applies here too.

Thomas Pornin
  • 320,799
  • 57
  • 780
  • 949
7

The problem you're facing have been already solved, and yes, you're going in the right direction: http://en.wikipedia.org/wiki/PBKDF2

Hubert Kario
  • 3,708
  • 3
  • 27
  • 34
  • 1
    So is `PBKDF2` a standardized way of doing what I'm doing with my own function? Or does it have other advantages? Maybe because of `HMAC`? (not sure I really understand what HMAC says). Thx! – Philippe Gerber Jul 12 '11 at 09:29
  • 3
    Yes, it's the standardized way. No, HMAC is different. – Hubert Kario Jul 12 '11 at 09:52