title: Password Hashing, BCrypt to SHA1/MD5
body: <p>I have been looking at upgrading the password hashing security of one of my applications as I have been reading up about brute force attacks being considerably faster then they used to. Currently I am using <code>sha1(md5($password))</code> and I see the benefits of using bcrypt + salt. My question is, Would it be any more secure if I were to do the following:</p>
  
  <p><strong>Scenario 1:</strong></p>
  
  <pre><code>$password -&gt; sha1 -&gt; bcrypt -&gt; sha1
  // This would enable me to keep all existing passwords and just 
  // regenerate all the hashes without waiting for the user to re login
  </code></pre>
  
  <p><strong>Scenario 2:</strong></p>
  
  <pre><code>$password -&gt; bcrypt -&gt; sha1
  // I would have to add an extra column for the new hash until every
  // user has logged in but the hash will still be sha1.
  </code></pre>
  
  <p>Would any of these two increase the security of the hash at all? I am no cryptographic master, far from it, I would just like a simple explanation as to if it would work, if not, and why.</p>
  
  <p>Thanks</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>After a little more reading, it seems that bcrypt is favoured because of its slowness in that i makes the cpu/gpu work longer before the hash is generated.</p>
  
  <p>In the case of sha1 vs bcrypt, sha1 is roughly 300000 times faster then bcrypt. Which begs the question, if bcrypts advantage is slowness, surely a recursive hashing function which uses sha1 300000 times would be as secure as bcrypt?</p>
  
  <p>I made this function as an example:</p>
  
  <pre><code>function bsha1($data, $salt) {
  
  $hash = $data;
  
  for ($i = 0; $i &lt; 300000; ++$i) {
  
  $hash = sha1($hash . $salt);
  
  }
  </code></pre>
  
  <p>Provide it with a salt and itll return a sha1 hash where every iteration is a hashed hash and salt. This takes approximately the same ammount of time as bcrypt. Would this be as secure?</p>