I'm very new to cryptography (and security in general, for that matter), but I had an idea that I'm sure is very flawed, but is worth asking. If a computer user, online account, etc, needs to verify a username and password, wouldn't this work well?
- Upon signup, ask for username and password as usual
- Hash username (
- Hash username, colon, password (
charliebucket:NgWB9pLx), using username hash as salt for user:pass hash.
- Upon login, hash username and user:pass
- Check if user:pass hash is the same, using hash of username as salt
- If user:pass hash succeeds, log in.
In my theory, this would prevent rainbow tables two-fold. If you require 8-character and up usernames and passwords, the pre-hash string will be at least 17 characters, making it unlikely that it would be on a rainbow table. But even if it were, it would take 3+ quadrillion years on a desktop PC, I'd assume it would take a good thousand on a million-dollar cluster.
As I said, I'm fairly new, and don't fully understand anything related to cryptography or hashing (besides "password go in, hash come out"), but I thought there might be a circumstance where this could be used.