It is important to make sure that password based key derivation takes place before passphrase correctness is checked. Otherwise, possible attacker can choose if they attack against passphrase correctness check or pbkdf function. (Appears ok on the both functions.)

• PasswordSafe

  In case of very high entropy key, it theoretically could be possible that for instance SHA-256(P') would be easier to break than the key. However, for any typical passwords, expected amount of entropy is (possibly) between 10 and 80 bits, and thus the passwords are likely weaker than the hash. (Thus appears ok.)

• bcrypt

I don't like decision to use blowfish encryption in crypt. This is because cryptographic key should usually be used only for very small (preferably one) purpose. The use in blowfish algorithm "consumes" allowed key uses. Maybe blowfish is the weakest link?

Overall, it seems that both choices should appear good enough for common practice, but I think the PasswordSafe's choice of SHA-256 appears even more conservative and secure. However, using SHA-256 appears extraneous as well.

It is important to make sure that password based key derivation takes place before passphrase correctness is checked. Otherwise, possible attacker can choose if they attack against passphrase correctness check or pbkdf function. (Appears ok on the both functions.)

• PasswordSafe

  In case of very high entropy key, it theoretically could be possible that for instance SHA-256(P') would be easier to break than the key. However, for any typical passwords, expected amount of entropy is (possibly) between 10 and 80 bits, and thus the passwords are likely weaker than the hash. (Thus appears ok.)

• bcrypt

  I don't like decision to use blowfish encryption in crypt. This is because cryptographic key should usually be used only for very small (preferably one) purpose. The use in blowfish algorithm "consumes" allowed key uses. Maybe blowfish is the weakest link?

Overall, it seems that both choices should appear good enough for common practice, but I think the PasswordSafe's choice of SHA-256 appears even more conservative and secure. However, using SHA-256 appears extraneous as well.

It is important to make sure that password based key derivation takes place before passphrase correctness is checked. Otherwise, possible attacker can choose if they attack against passphrase correctness check or pbkdf function. (Appears ok on the both functions.)

PasswordSafe

In case of very high entropy key, it theoretically could be possible that for instance SHA-256(P') would be easier to break than the key. However, for any typical passwords, expected amount of entropy is (possibly) between 10 and 80 bits, and thus the passwords are likely weaker than the hash. (Thus appears ok.)

bcrypt

I don't like decision to use blowfish encryption in crypt. This is because cryptographic key should usually be used only for very small (preferably one) purpose. The use in blowfish algorithm "consumes" allowed key uses. Maybe blowfish is the weakest link?

Overall, it seems that both choices should appear good enough for common practice, but I think the PasswordSafe's choice of SHA-256 appears even more conservative and secure. However, using SHA-256 appears extraneous as well.

It is important to make sure that password based key derivation takes place before passphrase correctness is checked. Otherwise, possible attacker can choose if they attack against passphrase correctness check or pbkdf function. (Appears ok on the both functions.)

• PasswordSafe

  In case of very high entropy key, it theoretically could be possible that for instance SHA-256(P') would be easier to break than the key. However, for any typical passwords, expected amount of entropy is (possibly) between 10 and 80 bits, and thus the passwords are likely weaker than the hash. (Thus appears ok.)

• bcrypt

I don't like decision to use blowfish encryption in crypt. This is because cryptographic key should usually be used only for very small (preferably one) purpose. The use in blowfish algorithm "consumes" allowed key uses. Maybe blowfish is the weakest link?

Overall, it seems that both choices should appear good enough for common practice, but I think the PasswordSafe's choice of SHA-256 appears even more conservative and secure. However, using SHA-256 appears extraneous as well.