How secure are sha256 + salt hashes for password storage

Question

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 for they are outdated and instead, I should use sha256 with salt. But, after reading this page on the php manual, I noticed that they discourage the use of even sha256 and instead they recommend using the password_hash() functions. I also noticed that most of this articles/pages were written in the interval of 2011-13, so I am not sure of how secure sha256 hashed password with salts are nowadays and whether or not it should still be used in webapps.

Answer 1

General-purpose hashes have been obsolete for passwords for over a decade. The issue is that they're fast, and passwords have low entropy, meaning brute-force is very easy with any general-purpose hash. You need to use a function which is deliberately slow, like PBKDF2, bcrypt, or scrypt. Crackstation actually explains this if you read the whole page. On the other hand, MD5 and SHA-1 aren't weaker than SHA-2 in the context of password hashing; their weakness is not relevant for passwords.

Answer 2

As @cpast says, the main problem of a single SHA-256 is that it is way too fast. An attacker with an off-the-shelf gaming GPU can try passwords at a rate that is counted in billions per second (American billions, but that's still a lot).

Another problem is that there is potential for combining things improperly. SHA-256 is a hash function: it takes one input, and produces an output. If you feed SHA-256 with a password and a salt, then you are really defining your own cryptographic protocols, based on SHA-256 with some extra things, the extra things telling how the password and the salt are combined to make the SHA-256 input. Designing cryptographic protocols is known to be hard, notably because there is no reliable test for security. You cannot know whether you did right. (Well, when your server has become hosts to a full party of hackers connecting from a dozen different countries you had never heard of, then you know that you did wrong, but it is a bit too late...)

Proper password hashing has a theory. Read this answer as a primer on the subject.

Answer 3

sha256 is not designed to hash passwords. To hash passwords, you should prefer to use hash functions created for this usage. You will find all required information below in another question addressing a similar request: Most secure password hash algorithm(s)?.

In the above mentioned question, you will learn why general purpose hash functions like sha256 do not have the right properties to ensure a secure storage of passwords (even when applied a large number of times on itself), and you will also find a ranking of the most-recommended hash functions dedicated for secure passwords handling:

1. scrypt: Which is still quite new (published in 2012), but is designed to ensure better security than its predecessor bcrypt,
2. bcrypt: It was designed specifically for password storage and was the recommended choice for a long time,
3. PBKDF2: It's actually designed as a key stretching function, ie. a secure way to derive a cryptographic key from a given password, but its properties make it also suitable for password storage.

In your question you mentioned the PHP function password_hash(). This function is not a hash algorithm per se. In fact, this function is used to allow PHP to select the most trusted password hash algorithm available without having to modify your code.

As indicated in the documentation, as per PHP 5.5.0, bcrypt is selected by default.