5 ms·
A question for the experts: Does it add any additional security to multi-layer multiple hash algorithms and/or multiple runs of the same algo? For example, sh
by forgotmypw17 5y ago
A question for the experts:
Does it add any additional security to multi-layer multiple hash algorithms and/or multiple runs of the same algo?
For example, sha1(md5(sha1(foo)))
- alexlur 5y agoIt will decrease the security.
- dannyw 5y agoIn this case yes as md5 has a lower bit size and both algos are broken. When done correctly, it increases the security. It's like encrypting a file with AES and then encrypting it with Twofish and then Serpent. The security is actually the strongest link; not the weakest. That's why bitcoin addresses use SHA256(RIPEMD160(X)) for output into a 160 bit hash.
- atq2119 5y agoThe "when done correctly" is a huge caveat, given that what you're replying to does it incorrectly. If X and Y collide, so that SHA-1(X) = SHA-1(Y), then f(SHA-1(X)) = f(SHA-1(Y)) no matter what f is -- so you get a collision. Concatenating the outputs of the hash functions fixes that particular issue. But concatenating makes preimage attacks easier.
- drdrey 5y agoPlease explain
- forgotmypw17 5y agoCan you please clarify why this is? I don't understand why it would decrease security.
- mrspuratic 5y agoI can't generalise for f(g(h(foo))), but as referred to in sibling comment (dannyw), the specific example sha1(md5(sha1(foo))) decreases security because the output of MD5 is 128 bits, compared with 160 bits for SHA-1. The arbitrarily long input foo is reduced to an input of 128 bits at the final step, and you only need to find that input for a collision (independently of any MD5-specific weakness you may also have added to the mix).
- jwilk 5y agoIt's not that simple. Finding collisions for md5(f(x)) could be harder than for md5(x) if f is a half-decent hash function. For the former, likely the best you could do is a (brute-force) brithday attack, with complexity ~64. OTOH, the best known collision attack on SHA-1 has complexity < 63.
- wave_function 5y agoNot an expert but this provably doesn’t add security. In your example, if sha1(foo)==sha1(bar), then foo, bar have a collision regardless of what you do afterwards. Maybe there’s some fancier layering scheme that adds security?
- tptacek 5y agoA fun note on this: https://cryptopals.com/sets/7/challenges/52 https://cryptopals.com/sets/7/challenges/52
- tedunangst 5y agoVery narrowly targeted comment to note that f(g(x)) and f(x) || g(x) are different operations.
- pvg 5y agoor multiple runs of the same algo? HMAC is, in part, a way to do that: https://en.wikipedia.org/wiki/HMAC https://en.wikipedia.org/wiki/HMAC
- userbinator 5y agoEarlier versions of TLS use MD5 + SHA1 not repeated, but applied side-by-side to produce a 288-bit hash; this presumably has a multiplicative effect on the strength, since now you have to generate a collision which satisfies both functions simultaneously.
- FartyMcFarter 5y agoHow about xor(sha1(X), md5(X)) ? With some padding to make them the same size.
- jwilk 5y agoNope. See this paper: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf https://www.iacr.org/archive/crypto2004/31520306/multicollis... > If F and G are good iterated hash functions with no attack better than the generic birthday paradox attack, we claim that the hash function F||G obtained by concatenating F and G is not really more secure that F or G by itself.