# Why authors of bcrypt have chosen blowfish and not some hash function like SHA-1?

I wonder what are the advantages of using bcrypt over an iterated and salted KDF based on some cryptographic hash function like SHA-1 (or SHA-3)? I guess the authors of bcrypt chose Blowfish (a block cipher) for a serious reason, but we could barely replace it in with SHA-1/SHA-3 (a hash function). What is wrong with such an approach? What are security properties brought by a block cipher that are not by hash functions?

• No one on this site can read the authors' minds, so any answer can only be speculative. Regarding SHA-1 in particular, this is actually a good thing: since around 2005 this should be considered deprecated and not used for new designs any more. But we can't know if the authors of bcrypt foresaw this in '99. – tylo Jul 3 '19 at 15:14
• SHA-1 was just an example. Replace it by SHA-3 if you prefer. I just wonder why they chose a block cipher and not a hash function. – matlink Jul 4 '19 at 12:40
• If there are 2 ways to achieve the same goal, and it comes down to just choosing one, they might have flipped a coin. The point is, there can be no definitive answer to this kind of choice except speculation, unless you ask the authors. And pure speculation is basically useless from a scientific point of view. – tylo Jul 4 '19 at 14:39
• It's important that a password stretching function based on an iterated function $f$ has just a few properties. (At least to be competitive with ancient algorithms like PBKDF2 and bcrypt). Computing $f^n(x)$ (as in $f^3(x) = f(f(f(x)))$) must not cost significantly less than $n$ times the cost to calculate $f(x)$ once. You want to maximize your efficiency of $f$ to give password crackers the smallest advantage possible. And the entire stretching function has to be one-way. It doesn't matter if you use a hash or block cipher because a one way function can be made from a block cipher. – Future Security Jul 6 '19 at 17:30
• @tylo with a quick google search, i could not find any indication that any of the bcrypt authors are dead. Niels Provos made a youtube video 4 days ago and appears to be very much alive. David Mazières made a twitter post 7 days ago, and also appears to be alive. (TIL one of the bcrypt authors is a youtuber! neat) – hanshenrik Sep 11 '19 at 20:35

A good way to find out what the authors meant would probably be reading their original paper where they introduced bcrypt : https://www.usenix.org/legacy/event/usenix99/provos/provos.pdf