SHA is correct because it's a cryptographic hash function, which is the proper way to store passwords. Passwords should be hashed (one-way), not encrypted (two-way). AES, 3DES, and RSA are encryption algorithms that can be reversed with the right key, making them unsuitable for secure password storage. If a database is compromised, encrypted passwords can be decrypted.