[vaoinwie]

why is multi-iteration sha-2 less ideal than bcrypt, even if the work factors between the two are calibrated to require the same amount of computation?

the only argument i've heard is that sha-2 can be implemented in specialized hardware (well-funded attacker) that is much much faster than CPU/GPU, whereas this is not as easy for bcrypt?

however, with multi-iteration hashing, you can strengthen the hash further w/o the user having to log in again.

[eneveu]

Regarding your question on the differences between bcrypt and iterated SHA-2, I think it's better if I link to comments by crypto / security experts:

http://news.ycombinator.com/item?id=1091465

> the only argument i've heard is that sha-2 can be implemented in specialized hardware (well-funded attacker) that is much much faster than CPU/GPU, whereas this is not as easy for bcrypt?

Yep. I think that's one of the main reasons. As tptacek said in the above link:

"There's a difference: bcrypt (and moreso scrypt) were designed to be hard to speed up, while SHA1 was designed at least in part to be easy to speed up."

In my opinion, the main advantage of bcrypt is the simplicity. It handles everything for you: salting, "slow" hashing, password checking. You simply have to specify a work factor and you are good to go. No need to implement any crypto yourself.

> however, with multi-iteration hashing, you can strengthen the hash further w/o the user having to log in again.

That's a very good point, I hadn't thought about that. I wonder if we can do this with bcrypt too.

IMO, as long as you use either bcrypt, scrypt, PBKDF2, or password stretching, you are good to go...