bugtraq - Re: Combining Hashes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 20 Feb 2005 11:30:05 -0600
From: Frank Knobbe <frank@...bbe.us>
To: Aaron Mizrachi <aaron@...acksecurity.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: Combining Hashes

On Sat, 2005-02-19 at 00:54 -0400, Aaron Mizrachi wrote:
> [...] The better 
> method (i think) is: HASH(HASH(data)), because adds two layer... and have the 
> same or more security than HASH(data). 

That's not an improvement. If you can fiddle data so that the inner hash
has the same value as before the fiddling, the outer hash remains the
same as well -- doesn't give you anything except a false sense of
security. Kent's idea was better in that you would have to find common
collisions in both algorithms in order to keep both hashes. 

Regards,
Frank

Download attachment "signature.asc" of type "application/pgp-signature" (188 bytes)