I'm working with some middleware that requires username/password authentication. The middleware uses MD5 hash for the password. The MD5 hash, of course, is not fit for the purpose of storing passwords. We need to address this.
We tried modifying the middleware to use a newer hash but it is a crap system we can't really change easily. However, we can control the web site that sits on top of it, and it's easy to change its code. So one of our developers had this idea:
When the user registers, the web site generates its own salt, then hashes the password with SHA-256 before passing it to the middleware. The middleware will then hash the password again using MD5 and its own salt.
When the user signs on, the web site retrieves its own salt then attempts to recreate the SHA-256 hash from the password that the user typed in. The web site then passes the SHA-256 hash to the middleware for validation. The middleware retrieves its own salt and attempts to recreate the MD5 hash from the salt and the SHA-256 that was passed in. If they match, the signon attempt is successful.
By combining the hashes in this manner, will my site be as secure as if were using the SHA-256 hash alone? Or does double hashing create some kind of vulnerability?