What is the strongest hashing algorithm commonly available today?

Question

I'm building a web application and would like to use the strongest hashing algorithm possible for passwords. What are the differences, if any, between sha512, whirlpool, ripemd160 and tiger192,4? Which one would be considered cryptographically stronger?

Celebrated

Define what you mean by "strongest". – Pomona

I usually think of the resources required to find an input that hashes to a given value. – Appellative

Answer 1

bCrypt - Why would be a very long explanation, for which I recommend Enough With The Rainbow Tables: What You Need To Know About Secure Password Schemes

Basically, it's secure, it's slow, it's already implemented.

Smalltime

bcrypt is not really a hashing algorithm, it's a technique that uses other hashing algorithms. – Gunpaper

Answer 2

If you are actually concerned about the security of your system (as opposed to the quite academic strength of algorithms) then you should go with a proven and mature implementation instead of nitpicking algorithms.

I would recommend Ulrich Drepper's SHA-crypt implementation. This implementation uses SHA-512, a 16 character long salt, is peer reviewed and scheduled to go into all major Linux distributions via glibc 2.7.

---

P.S.: Once you have reached this level of security, you'll be visited by the black helicopters anyways.

Ostentation

Answer 3

David, those are all plenty strong functions. Even the much-ballyhooed MD5 collisions are not of the password-cracking variety, they just generate two different strings with the same MD5 (a very different proposition from finding a string that generates a given MD5 value).

If you are concerned about the security of the passwords, you need to worry about the protocols used to store them, the protocols used to recover passwords forgotten by users, and all the other possible avenues of attack. Those options are used far more often to crack passwords than brute-force crtyptanalysis.

Do use a salt, though.

But first read the article AviewAnew posted

Lectra

Answer 4

Here's a good post on coding horror about storing passwords. In short, he suggests bcrypt or SHA-2 with a random unique salt.

Auschwitz

Answer 5

MD5 and SHA are the two most popular hashing algorithms. SHA-256 uses a 256-bit hash, whereas MD5 produces a 128-bit hash value. So, SHA-256 should be good choice as it is the strongest hashing algorithm. You can find some useful case here -> https://codesigningstore.com/what-is-the-best-hashing-algorithm

Washburn