3 ms·
I can't generalise for f(g(h(foo))), but as referred to in sibling comment (dannyw), the specific example sha1(md5(sha1(foo))) decreases security because
by mrspuratic 4y ago
I can't generalise for f(g(h(foo))), but as referred to in sibling comment (dannyw), the specific example
sha1(md5(sha1(foo)))
decreases security because the output of MD5 is 128 bits, compared with 160 bits for SHA-1. The arbitrarily long input foo is reduced to an input of 128 bits at the final step, and you only need to find that input for a collision (independently of any MD5-specific weakness you may also have added to the mix).
- jwilk 4y agoIt's not that simple. Finding collisions for md5(f(x)) could be harder than for md5(x) if f is a half-decent hash function. For the former, likely the best you could do is a (brute-force) brithday attack, with complexity ~64. OTOH, the best known collision attack on SHA-1 has complexity < 63.