Scrypt + Bcrypt = cascade hashing

Question

I've read here that hashing with differents algorithms would be a good idea.

Can you confirm that?

In your experience, is it useful and safe? Does it entail any security holes?

Answer 1

Generally speaking, cascading algorithms is rarely a good idea. Cascading works very well at making software more complex and less responsive, which is hardly desirable. The usual "justification" of cascading is that it should somehow (possibly magically) resist complete breakage of one of the algorithm, but not of the other. In practice, this is not so, for several reasons:

• There are several ways to "cascade" and they do not do the same thing. For instance, if you have hash functions f and g, and you want to protect against preimages, then cascading as f(g(x)) might work; but if you want to protect against collisions, that's f(x)||g(x) which makes sense (i.e. concatenation, not composition). People who request cascading rarely think about what they actually want with sufficient depth in that respect.

• Let's face it, this is not 1938 anymore. The algorithm itself is never the weak point; what's weak is how it is (mis)used. Cascading is like looking at a steel door on a wood cabin, and claiming that it should have an extra, heavy padlock in addition. It is a great and time-honoured way to avoid dealing with real security issues.

• In the specific case of password hashing, there is one glaring weakness, which is the password itself: passwords are guessable. So we want slow hash functions, and we defeat the attacker by putting more CPU into it ourselves (i.e. we increase the number of iterations, so that the hash is as expensive as possible; the attacker's advantage becomes how much more CPU he can muster when compared to the honest server). The server's CPU is his line of defense. Cascading means wasting precisely that lifeforce, just for the fuzzy feeling that it will make things more resistant to fabled cryptanalytic breaks.

So no, don't cascade. At best, it will just make your life harder. More often, it will more or less directly decrease security.

Answer 2

Seeing that I wrote that blog post I thought I would chime in. First, let me explain that it was a quick 5-minute writeup so it was not some well-analyzed theory, more of an off-the cuff comment. I wrote it because I had seen several discussions at the time arguing which specific algorithm was best.

The original point was, rather than argue which one is better, just use both and be done with it.

Since writing that, I have done considerable more research in the area and clearly I had overstated the benefits. Simply doing something like sha256(blowfish(data)) is not as resistant to attack as it sounds. There are ways to pull it off but doing it correctly takes some solid understanding of cryptography, there are some tradeoffs, and it would be too easy to mess up. It's highly unlikely that you would make it less secure, but the gains are minimal for the most likely attacks.

That post of mine perfectly illustrates how hard it is to do cryptography correctly and how you should take great care in how you implement it. The concept of combining algorithms sounds perfectly logical but when you sit down and properly analyze it, the results are not as great as expected, or in some cases, could even be worse.