bugtraq - Re: [lists] Combining Hashes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 19 Feb 2005 00:14:27 -0500
From: Elliott Bäck <ecb29@...nell.edu>
To: Kent Borg <kentborg@...g.org>, bugtraq@...urityfocus.com
Subject: Re: [lists] Combining Hashes

Kent Borg wrote:

>I admit I don't know why this might be significantly better than
>d1+d2, I was hoping someone here would.
>  
>

I think there are a couple things going on here.  First, since + is 
concatenation, SHA-1(SHA-1(data)+data+MD5(data)) provides an input to 
the hash that is three times as long as before.  I'm also not familiar 
with the inner workings on SHA-1 and MD-5, but the second idea here is 
that they both represent (somewhat) orthogonal solution spaces, so that 
the concatenation of both of them adds more dimensionality and therefore 
more uniqueness.

However, I am just guessing here off the top of my head.

Thanks,
Elliott C. Bäck

607-229-0623
http://elliottback.com