Given the increase in hash rate since the rise of numerous block chains, I wonder how this affects the security of many hashed password systems.
- Is a standard linux
/etc/shadow
file still regarded safe or does it somehow need to be updated with another algorithm or bigger salt or in some other way? - Are hashed passwords using hmac with sha256 safe given a 20 character long secret key? Can someone give some rough calculations to give an idea how long it takes to find a password?
- Is it advisable to use hmac with a slower algorithm like bcrypt, scrypt or PBKDF2?
By "safe" I mean can modern hardware like ASIC reproduce a given hash in a reasonable amount of time. Some background context to my question. User input will be one way encrypted (hmac sha256) stored in a database. Suppose the database is hacked, how hard is it for an attacker to find original user input. If it turns out this type of encryption is too easy for asic machines, should I switch to some other one way encryption like bcrypt or pbkdf2?