SHA1 might (I think it is, but I'm not sure) be faster than DES; among other differences, DES crypt(3) has to run the DES key schedule before producing a hash. Data slips through SHA1 like a greased seal.

Looks like you're right.. these benchmarks show SHA1 about 5x faster than DES: http://www.cryptopp.com/benchmarks.html

Ah, alright. I was thinking there was some kind of length-extension weakness (which doesn't apply here, which is why I was confused) or some other attack in the cryptographic sense. Thanks.

SHA1(salt || password) does have a length-extension property; you can easily compute SHA1(salt || password || junk || arbitrary-data) for any given hash. That's not very useful for password hashes, but is devastating for the kinds of SHA1-based authentication schemes that people who write their own password hashes seem to come up with.

Yeah, by "doesn't apply" I meant "that's not very useful for password hashes".

A machine with a few GPUs can compute hundreds of millions of SHA1 hashes per second.

http://www.win.tue.nl/cccc/sha-1-challenge.html

Or go commercial: http://www.digitalintelligence.com/products/rack-a-tacc/