Change the default password encryption The default password encryption in Drupal 6 is MD5. Is it right? I want to change it to something more difficult like crypt and sha1. 

Is there any module for this purpose, or do I have to hack the core myself?
Yes, you can look for the Secure Password Hashes module.

This module stores password hashes securely.
The default password hashes in Drupal 6 (and before) are rather insecure. MD5 is easy to crack, should an attacker find a database dump or gain access to your database. This module implements secure password hashes using the phpass password hashing method - multiple rounds of hashing and salting that make reversing the hash significantly more difficult to break by brute-force attack. This is the same approach that is used for Drupal 7.