5 ms·

I've always wondered if there's a security issue by applying the newer hashing algorithm to the old hashes. I.e. store the result of `argon(bcrypt(md5(password

by cstuder 11y ago

I've always wondered if there's a security issue by applying the newer hashing algorithm to the old hashes. I.e. store the result of `argon(bcrypt(md5(password)))` Any security drawbacks to this?

deleted 11y ago
[deleted]
wolfwyrd 11y ago
Here's a discussion on that[0]. Depending on how you do it you either weaken it to the strength of the weakest algorithm or alternatively gain nothing but may introduce a weakness. It's basically a bad idea. https://security.stackexchange.com/questions/93730/why-not-mix-hashes/93748 https://security.stackexchange.com/questions/93730/why-not-m... [0]
- emn13 11y ago
  The arguments in that Q&A look suspect to me - they don't seem to be explicit in what a hash needs to defend against, and as a result, any downside is an argument to avoid a strategy, even if that downside is much less relevant than some other upside. The top voted answer has a comment that's spot on: I would offer the opposite argument: if one uses a single hashing function which has a 0.1% chance of having a discoverable weakness that would allow an attacker to speed it up by a factor of a million, there will be a one-in-a-thousand chance that an attacker will be able to gain a million-fold speedup. If one used three independent functions, each of which had a 0.1% chance of allowing such a breakthrough, there would be a 0.3% chance of an attacker being able to achieve a 33% speedup, a 0.0003% chance of an attacker getting a 66% speedup, and only a 0.0000001% chance of an attacker... – supercat Jul 13 '15 at 17:21 ...getting a million-fold speedup. I would consider the possibility of an attacker getting a 33% speedup as inconsequential compared to the reduction in the probability of the attacker getting a 70%-or-better speedup. – supercat Jul 13 '15 at 17:22 In short: You lose on average (but who care?) but you reduce the risk of catastrophic failure.

by cstuder 11y ago

I've always wondered if there's a security issue by applying the newer hashing algorithm to the old hashes. I.e. store the result of `argon(bcrypt(md5(password)))` Any security drawbacks to this?

deleted 11y ago

[deleted]

wolfwyrd 11y ago

Here's a discussion on that[0]. Depending on how you do it you either weaken it to the strength of the weakest algorithm or alternatively gain nothing but may introduce a weakness. It's basically a bad idea. https://security.stackexchange.com/questions/93730/why-not-mix-hashes/93748 https://security.stackexchange.com/questions/93730/why-not-m... [0]

emn13 11y ago
The arguments in that Q&A look suspect to me - they don't seem to be explicit in what a hash needs to defend against, and as a result, any downside is an argument to avoid a strategy, even if that downside is much less relevant than some other upside. The top voted answer has a comment that's spot on: I would offer the opposite argument: if one uses a single hashing function which has a 0.1% chance of having a discoverable weakness that would allow an attacker to speed it up by a factor of a million, there will be a one-in-a-thousand chance that an attacker will be able to gain a million-fold speedup. If one used three independent functions, each of which had a 0.1% chance of allowing such a breakthrough, there would be a 0.3% chance of an attacker being able to achieve a 33% speedup, a 0.0003% chance of an attacker getting a 66% speedup, and only a 0.0000001% chance of an attacker... – supercat Jul 13 '15 at 17:21 ...getting a million-fold speedup. I would consider the possibility of an attacker getting a 33% speedup as inconsequential compared to the reduction in the probability of the attacker getting a 70%-or-better speedup. – supercat Jul 13 '15 at 17:22 In short: You lose on average (but who care?) but you reduce the risk of catastrophic failure.