Bcrypt for password hashing because it is slow?
hash, security
Solution
Because if it takes more time to hash the value, it also takes a much longer time to brute-force the password.
Keep in mind that slow means that it requires more computing power. The same goes for when a potential hacker tries to brute-force a password.
Problem
I read today on not-implemented.com : Sha-256 should be chosen in most cases where a high speed hash function is desired. It is considered secure with no known theoretical vulnerabilities and it has a reasonable digest size of 32 bytes. For things like hashing user password, though, a function designed to be slow is preferred: a great one is bcrypt. Can somebody explain the last sentence : For things like hashing user password, though, a function designed to be slow is preferred: a great one is bcrypt. I don't say it's not correct, my question is simply: Why it is preferred for hashing user password to use a slow function ?