Relation between encryption algorithms and (password) hash functions

Question

This is a really basic question.
Blowfish is not seen as a secure cipher.
but bcrypt is one of the most secure hash functions.
So first: How can a hash function be based on an encryption algorithm, after all these two things have little to do with each other?
Second: If blowfish is insecure and bcrypt is based on it, how can it be secure ?
And just a little question regarding bcrypt: In Linux-based operating systems the code for hashes is

 $1 – MD5
$2 – blowfish
$2a – eksblowfish
$5 – SHA-256
$6 – SHA-512

With "blowfish" they actually mean bcrypt, right?

Answer 1

This is just a sketch of the idea but I think the reasoning is as follows:

1. The output of a good block cipher looks random so you can think of a block cipher as a PRF.
2. If you have a PRF you can do simple things like throwing away half of the output to turn it into a compression function.
3. Hash functions are traditionally built from such compression functions. Usually in a Merkle-Damgård construction.

Clearly the security of the Hash function depends on the security of all these building block and the precise steps taken in between.

Even if blowfish may have weaknesses it is possible that the output still has sufficient entropy that it can be turned into a good compression function. Note that according to Wikipedia the problem with blowfish is its small block size which doesn't affect the PRF property.

EksBlowfish is a step of bcrypt. As described in the publication.