Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
4 of 11 polish

From the standpoint of collision-resistance and second-preimage-resistance, the concatenation of multiple hashes is at least as secure as the strongest of the hashes (any attack that breaks the concatenation is turned into an attack that breaks each hash).

From the standpoint of first-preimage-resistance, the concatenation of multiple hashes is no more secure than the least secure of the hashes (any attack that breaks any hash is turned into an attack that breaks the concatenation).

For many iterated hashes including all Merkle-Damgård hashes (thus MD5, SHA-1, the various SHA-2), using the concept of multicollisions, it can be shown that the concatenation of multiple hashes is not much more secure against collisions than the strongest of the hashes. See Antoine Joux: Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions, in proceeding of Crypto 2004.

The above article strongly suggests that among using 128 bits from SHA-512 plus 128 bits from MD5 (or) using 256 bits from SHA-512, the later is much safer. The only assurance we have about the former is that it is not worse than SHA-512 truncated to 128 bits, which can be attacked in about 264 hashes, when we expect the later to require about 2128 hashes to attack.