Again, if you really need to use a secret algorithm, instead use a secret key with the known proven algorithm (see for example https://wiki.mozilla.org/WebAppSe

Again, if you really need to use a secret algorithm, instead use a secret key with the known proven algorithm (see for example https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Password_Storage https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#...) That the security of a cipher system should depend on the key and not the algorithm has become a truism in the computer era, and this one is the best-remembered of Kerckhoffs's dicta. ... Unlike a key, an algorithm can be studied and analyzed by experts to determine if it is likely to be secure. An algorithm that you have invented yourself and kept secret has not had the opportunity for such review. http://en.wikipedia.org/wiki/Kerckhoffs%27s_principle#Implications_for_analysis http://en.wikipedia.org/wiki/Kerckhoffs%27s_principle#Implic... Moreover, you made the security of your system "key"-dependent: what if I generate such "key" that will only use 5 iterations of MD5 and 1 iteration of SHA-1? This would be a major failure. Imagine if the security of AES was not 2^128, but varied between 2^10 to 2^128 depending on what key you supplied -- would you use it?