I'm a rookie when it comes to Information Security so I've been reading a lot of the top questions on this stackexchange for the sake of learning. I came across this question that discusses hashing. In criticism of a home-brew security algorithm, people repeatedly say that shuffling a hash adds no security.
A comment that I can't find an answer for:
$nt = substr($pass,0,8); // <--- BAD BAD BAD - why shuffle an MD5 hash?!?!?
Again hash =
sha1($salt+md5'($password)). Rearranging the MD5 adds no security
ccddeeff8899aabb0011223344556677)the swap does not prevent you from using md5 rainbow tables after (e.g., look at the code and reverse the swap). However, the presence of the unique salt makes the rainbow tables infeasible.
There must be something I don't understand about hashing. It seems to me rearranging the characters in the hash randomly would offer a sort of security? Clearly that's not the case, but What mistake am I making? I'm ignorant of my own ignorance right now.