I've read here that hashing with differents algorithms would be a good idea.
Can you confirm that?
In your experience, is it useful and safe? Does it entail any security holes?
|show 2 more comments|
Generally speaking, cascading algorithms is rarely a good idea. Cascading works very well at making software more complex and less responsive, which is hardly desirable. The usual "justification" of cascading is that it should somehow (possibly magically) resist complete breakage of one of the algorithm, but not of the other. In practice, this is not so, for several reasons:
So no, don't cascade. At best, it will just make your life harder. More often, it will more or less directly decrease security.
Seeing that I wrote that blog post I thought I would chime in. First, let me explain that it was a quick 5-minute writeup so it was not some well-analyzed theory, more of an off-the cuff comment. I wrote it because I had seen several discussions at the time arguing which specific algorithm was best.
The original point was, rather than argue which one is better, just use both and be done with it.
Since writing that, I have done considerable more research in the area and clearly I had overstated the benefits. Simply doing something like sha256(blowfish(data)) is not as resistant to attack as it sounds. There are ways to pull it off but doing it correctly takes some solid understanding of cryptography, there are some tradeoffs, and it would be too easy to mess up. It's highly unlikely that you would make it less secure, but the gains are minimal for the most likely attacks.
That post of mine perfectly illustrates how hard it is to do cryptography correctly and how you should take great care in how you implement it. The concept of combining algorithms sounds perfectly logical but when you sit down and properly analyze it, the results are not as great as expected, or in some cases, could even be worse.