I understand it is important to hash passwords over multiple iterations to make things harder for an attacker. I have read numerous times that when processing these iterations, it is critical to hash not only the result of the previous hashing, but also append the original salt each time.

In other words, I think I need to not do this:

var hash = sha512(salt + password); 
for (i = 0; i < 1000; i++) {
    hash = sha512(hash); 
}

And instead, I can do this:

var hash = sha512(salt + password); 
for (i = 0; i < 1000; i++) {
    hash = sha512(salt + hash); 
}

My question is regarding the math here. Why does my bad example above make things easier for an attacker? I've heard that it would increase the likelihood of collisions but I am not understanding why.

_{reposted from http://stackoverflow.com/questions/21003216/why-do-i-need-to-add-the-original-salt-to-each-hash-iteration-of-a-password}

I understand it is important to hash passwords over multiple iterations to make things harder for an attacker. I have read numerous times that when processing these iterations, it is critical to hash not only the result of the previous hashing, but also append the original salt each time.

In other words, I think I need to not do this:

var hash = sha512(salt + password); 
for (i = 0; i < 1000; i++) {
    hash = sha512(hash); 
}

And instead, I can do this:

var hash = sha512(salt + password); 
for (i = 0; i < 1000; i++) {
    hash = sha512(salt + hash); 
}

My question is regarding the math here. Why does my bad example above make things easier for an attacker? I've heard that it would increase the likelihood of collisions but I am not understanding why.

_{reposted from https://stackoverflow.com/questions/21003216/why-do-i-need-to-add-the-original-salt-to-each-hash-iteration-of-a-password}

In a nutshell, this is my question: http://stackoverflow.com/questions/21003216/why-do-i-need-to-add-the-original-salt-to-each-hash-iteration-of-a-password?noredirect=1#comment31574539_21003216

I understand it is important to hash passwords over multiple iterations to make things harder for an attacker. I have read numerous times that when processing these iterations, it is critical to hash not only the result of the previous hashing, but also append the original salt each time.

In other words, I think I need to not do this:

var hash = sha512(salt + password); 
for (i = 0; i < 1000; i++) {
    hash = sha512(hash); 
}

And instead, I can do this:

var hash = sha512(salt + password); 
for (i = 0; i < 1000; i++) {
    hash = sha512(salt + hash); 
}

My question is regarding the math here. Why does my bad example above make things easier for an attacker? I've heard that it would increase the likelihood of collisions but I am not understanding why.

_{reposted from http://stackoverflow.com/questions/21003216/why-do-i-need-to-add-the-original-salt-to-each-hash-iteration-of-a-password}