Passwords storage, hash() with sha-512 or crypt() with blowfish (bcrypt)?

Question

This is my current password hashing procedure in PHP/SQL projects...

• Take 512bits of per-user salt from /dev/urandom, stored in the user\'s DB record in additi

Answer 1

You are definitely on the right track, bcrypt is a very nice way to store your passwords (scrypt is better but hard to find a good implementation in PHP).

Remember that sha1, sha256, sha512 were never made to hash passwords. They were designed to be fast, so that you could take large data sets and create a unique signature for them, in the shortest amount of time. They are used for signing more than anything else.

You definitely want to use a hashing algorithm that takes more time.

Side note: Some would argue that the pepper is pointless, since if they hack your system, they will have access to your salts and pepper.

This post has some great insights into password security.

Answer 2

If you can wait til php 5.5, there will be some helpful functions for this built in:

https://gist.github.com/3707231

Till then, use crypt - you could look at this forward compatible port of the new functions:

https://github.com/ircmaxell/password_compat