What were your timings like for bcrypt using 12 rounds? Also, while for the SHA-x algorithms, there have been numerous tests--what about for the pycrypt module?
Timings are going to be completely dependent on the server. Anything I tell you will be wrong unless you're running on my server.
And I didn't test any SHA-x algorithms. Any algorithm that has a time you can't easily increase by tweaking a number (BCRYPT_ROUNDS) will eventually become insecure as computers get faster.
It's not straight SHA-x, I'd wager; glibc includes a version of phk's MD5-based crypt() based on SHA2 (with some bonus insanity thrown in; it's a spawn of MD5 crypt and Drepper, after all.)
Like md5crypt, this new crypt() is not based on established cryptographic principles.
Comments
What were your timings like for bcrypt using 12 rounds? Also, while for the SHA-x algorithms, there have been numerous tests--what about for the pycrypt module?
Timings are going to be completely dependent on the server. Anything I tell you will be wrong unless you're running on my server.
And I didn't test any SHA-x algorithms. Any algorithm that has a time you can't easily increase by tweaking a number (BCRYPT_ROUNDS) will eventually become insecure as computers get faster.
It's not straight SHA-x, I'd wager; glibc includes a version of phk's MD5-based crypt() based on SHA2 (with some bonus insanity thrown in; it's a spawn of MD5 crypt and Drepper, after all.)
Like md5crypt, this new crypt() is not based on established cryptographic principles.