Add support for other hashing mechanisms
ketan opened this issue · 0 comments
ketan commented
SHA1 as a password hashing mechanism has been deprecated. Industry standard recommendation is bcrypt or PBKDF2.
From this page
What hash algorithm should I use?
DO use:
- Well-designed key stretching algorithms such as PBKDF2, > bcrypt, and scrypt.
- OpenWall's Portable PHP password hashing framework
- My implementations of PBKDF2 in PHP, C#, Java, and Ruby.
- Secure versions of crypt (
$2y$ ,$5$ ,$6$ )DO NOT use:
- Fast cryptographic hash functions such as MD5, SHA1, SHA256, SHA512, RipeMD, WHIRLPOOL, SHA3, etc.
- Insecure versions of crypt (
$1$ ,$2$ ,$2x$ ,$3$ ).- Any algorithm that you designed yourself. Only use technology that is in the public domain and has been well-tested by experienced cryptographers.