Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your system. That would naturally result in different types of hashes stored for old and new users.
I wonder would it be acceptable if I just stored the algorithm used in the database prepended to each hash? Something similar to how the output of bcrypt looks:
$2a$... (the algorithm version). What if I stored it by name like
Does it make things considerably worse to explicitly expose the algorithm used? I'm thinking, even if the attacker knows the exact algorithm (of a very few) it is more or less the same order of work to crack it, x1 or x5 is not a big deal, the same O(effort). But it makes things simpler for me to manage.
What do you experts think?
Update. I was thinking about another option such as referring to a particular algorithm by codes such as alg1, alg2 and writing down the explanations of those references somewhere else, in the application, perhaps, to keep this information at hand. If my original idea should turn out bad, would this approach correct it?