Bcrypt(4) (=4 iterations) versus SHA512 or something different with unique salt per password?
===

**Background:**

I want to add a login to my small site, which is an online php application, which I'd like to build to be able to bear much user activity in the future.

Before I look further into implementing LightOpenID I want to add a normal login. The book I was learning from is called Head First PHP & MySQL (2008) and the final code of the chapter uses `SHA('$user_password')` as part of the mysql query.

As I take interest in Jeff Atwood's writing I'm well aware of bcrypt as of scrypt. But seen as there's no php implementation of scrypt and having no dedicated server to run it, I decided to at least look into implementing bcrypt for now.

However I'm not completely naive, I know I should watch out not to overextend my very humble hosting resources. The php app itself should always come first before anything else concerning resources.

[Andrew Moore's method][1] seems nice (though I'll have to see how to implement it on php 5.2.17 which my host uses) and it comes with a tip for hardware speed:

> You should select a number of rounds that results in 200-250 ms of
> work. Part of the reason why bcrypt is secure is that it is slow. You
> must ensure to have a number of rounds that keeps that characteristic.
> – Andrew Moore

Another user states that for him running `microtime()` gives 0.314 for Bcrypt(9), which thus would be near optimal.

**The question:**

Seen as I only have very humble resources at my disposal and I'd like to make the best of them, leaving most for the php app itself, **am I still better off using Bcrypt(4) instead of something else?**

Bcrypt(4) returns true almost instantly, but does it still keep that characteristic Moore talks about?(Would that be the part concerning RAM that makes it harder for GPU bruteforcing?) Or would SHA512 **or something else** actually be as fast but more secure at this point?

I'd expect Bcrypt(4) to win in this situation, but the hell do I know right? :p


  [1]: http://stackoverflow.com/questions/4795385/how-do-you-use-bcrypt-for-hashing-passwords-in-php 