I'm guessing you haven't read Provos and Mazières' USENIX paper. In the design considerations, they say:<p><i>In general, a password algorithm, whatever its cost, should execute with near optimal efficiency in any setting in which it sees legitimate use, while offering little opportunity for speedup in other contexts.</i><p>PBKDF1 and PBKDF2 both rely upon general-purpose hash functions, which are <i>much</i> faster in dedicated computing environments such as FPGA or GPU clusters. The Eksblowfish algorithm at the heart of bcrypt is <i>extremely</i> resistent to optimization.<p>This is crucial for password storage, since if a CUDA implementation is 3-4 orders of magnitude faster than the implementation your application uses, you've just chipped off a huge chunk of the advantage offered by your hash function.