Hacker News Reader

Comment by alexlur | Hacker News Reader

It will decrease the security.

I can't generalise for f(g(h(foo))), but as referred to in sibling comment (dannyw), the specific example sha1(md5(sha1(foo)))

decreases security because the output of MD5 is 128 bits, compared with 160 bits for SHA-1. The arbitrarily long input foo is reduced to an input of 128 bits at the final step, and you only need to find that input for a collision (independently of any MD5-specific weakness you may also have added to the mix).

It's not that simple. Finding collisions for md5(f(x)) could be harder than for md5(x) if f is a half-decent hash function. For the former, likely the best you could do is a (brute-force) brithday attack, with complexity ~64. OTOH, the best known collision attack on SHA-1 has complexity < 63.

In this case yes as md5 has a lower bit size and both algos are broken.

When done correctly, it increases the security. It's like encrypting a file with AES and then encrypting it with Twofish and then Serpent.

The security is actually the strongest link; not the weakest.

That's why bitcoin addresses use SHA256(RIPEMD160(X)) for output into a 160 bit hash.

The "when done correctly" is a huge caveat, given that what you're replying to does it incorrectly. If X and Y collide, so that SHA-1(X) = SHA-1(Y), then f(SHA-1(X)) = f(SHA-1(Y)) no matter what f is -- so you get a collision.

Concatenating the outputs of the hash functions fixes that particular issue. But concatenating makes preimage attacks easier.

Can you please clarify why this is? I don't understand why it would decrease security.

Please explain

Reply on news.ycombinator.com