Note: I am relatively new to cryptography in general, so please point out if I make any
I heard that you should always use well known crypto/hash functions, that have already been extensively tested and studied. -and I agree with that- I also read that using scrypt can be risky because it is still in its early years, but it seems to solve problems like attacks using FPGAs or GPUs.
"My" great idea was to use two hashes! One extensively tested like PBKDF2 and scrypt after it! So I would be in theory protected by scrypt and if any bugs/exploits/problems with it are found, I still have the protection of well know protection provided by PBKDF2!
Are there any flaws on this idea?
No, it is not a duplicate of this question: This question “Double hashing” with 2 different hash functions says that I would not benefit by using two hashes, but it is regarding sha256 and sha512, so I am not certain if this also applies to PBKDF2 and scrypt.
On the other hand, this post here Are different hash algorithms ever used together? says that if used as Composition it would offer "preimage resistance is at least as good as the strongest of the two functions, but for collisions the weakest function defines the overall resistance". As far as I know, collisions would not be the issue here...
You can assume that I just want to hash and store passwords.