Am I wrong to think that scrypt(bcrypt(password)) would be better than using sole (s|b)crypt? Especially when considering two different key for the two algorithms.
I am also interested in some papers.
|show 1 more comment|
scrypt(bcrypt(password)) will be less secure when considering the attack model scrypt is geared against - namely requiring as expensive hardware as possible for brute force attacks.
However, if you believe that the scrypt construction or the primitives used in scrypt (SHA256, Salsa20) are prone to failure, using bcrypt as well brings in another cryptographic primitive (blowfish). However, it might just as well be that there is absolutely no benefit.
In general, I would strongly advise against combining methods like this without actually understanding the ramifications and proving that some meaningful benefit is gained.
Edit: Oh, in case you didn't know, scrypt uses PBKDF2 both before and after its own method, which is probably the most widely used method for strong password hashing - certainly much more used than bcrypt.
Edit: Probably the closest cryptographic papers on the issue are those evaluating the combination of SHA1 and MD5 in the TLS PRF construction, such as: Hash Function Combiners in TLS and SSL.
I'm not entirely sure about the policy here, but when something is almost less than a Google search away, should that really be put here as a question?
Determining if scrypt(bcrypt(password)) is better than sole (s|b)crypt depends entirely on your definition for "better".
While I certainly make no claims to be even remotely competent or experienced with cryptography, combining them would to me appear to be stronger rather than using them on their own.