Onderwerp: Combining Hashes

Concatenating two different hashes, for example SHA-1 and MD5,
apparently does not add as much security as one might hope.

What about more complicated compositions? For example, a reader
comment posted on Bruce Schneier's blog
(http://www.schneier.com/blog/archive...a1_broken.html)
suggests the following:

d1=SHA-1(data)
d2=MD5(data)
d3=SHA-1(d1+data+d2)

The final digest would be d1+d2+d3

(where "+" is concatenation)


I admit I don't know why this might be significantly better than
d1+d2, I was hoping someone here would.


-kb

--nextPart3139828.TSXPv0hb7d
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

El Vie 18 Feb 2005 11:24, Kent Borg escribi=F3:
> Concatenating two different hashes, for example SHA-1 and MD5,
> apparently does not add as much security as one might hope.
>
> What about more complicated compositions? For example, a reader
> comment posted on Bruce Schneier's blog
> (http://www.schneier.com/blog/archive...a1_broken.html)
> suggests the following:
>
> d1=3DSHA-1(data)
> d2=3DMD5(data)
> d3=3DSHA-1(d1+data+d2)
>
> The final digest would be d1+d2+d3
>
> (where "+" is concatenation)
>
>
> I admit I don't know why this might be significantly better than
> d1+d2, I was hoping someone here would.
>
>
> -kb

Having d1+d2 may leave some useful information in order to obtain a colliti=
on=20
more fastest because we can intersect these functions... SHA-1(d1+data+d2) =
is=20
relative better than d1+d2. I dont think that is really secure... d2 or d1=
=20
may leave some useful information. we need to study and probe that.=20

I dont recomend something as: HASH(HASH(data)+data) until a research of=20
propietries of that where investigated and mathematical proved. The better=
=20
method (i think) is: HASH(HASH(data)), because adds two layer... and have t=
he=20
same or more security than HASH(data). it's simple... if you use HASH(data)=
,=20
you can obtain HASH(HASH(data)), and crack from HASH(HASH(data)) (if 2-ble=
=20
round hash is more weakness).

A simple probe of a very basic crypto-system that isn't good idea have two=
=20
rounds are: XOR, the second round leave the original text. With one way=20
functions may happen something similar.


--nextPart3139828.TSXPv0hb7d
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBCFsap1g9naXXPeA4RAsVRAKDFyXmWTNcPZpDRZGjumq 7B5Dq+UQCfWUtb
xZOC613aiz+51ZdkYThcv7w=
=WWOM
-----END PGP SIGNATURE-----

--nextPart3139828.TSXPv0hb7d--