http://www.openwall.com/lists/announce/2011/06/21/1 - some bcrypt implementations out there are still broken if they used this code. You may give the SHA-based scheme a chance.