What is the safest algorithm in the Kohana auth module?

Question

I would prefer to use the crypt function and use blowfish encryption, but the current implementation of this module uses a hash function that does not offer this encryption method. So what is the safest algorithm in the Kohana auth module? Would SHA-512 be a good option, or would I rather modify the module to use crypt and blowfish?

Answer 1

From the answer to this stackoverflow question: SHA512 vs Blowfish and Bcrypt

Suffice it to say whether bcrypt or SHA-512 is really good enough. And also the answer is yes, or an algorithm for a violation to occur through a lack of implementation, and not cryptanalysis.

In other words, it seems more reasonable to use a somewhat simplified implementation already in Cohan against trying to modify the module and potentially introduce new implementation errors.

Answer 2

SHA-512 seems to be your best bet.

To summarize related content with danieltalsky's answer, the bad thing about SHA-512 is that it is fast. This is a great hash, but SHA-512 speed means that an attacker with a copy of your hashed passwords can do more guessing per second. bcrypt is a much slower hash, so it will take longer to verify each password guess, and therefore, one of the weak user passwords can be found longer.

You can go and try adding bcrypt or some form of extension to the Kohana authorization module, but your time is probably better spent to make sure your server throttles the speed at which users can try to log into the system.