I once heard that if implementing a password hashing scheme, simply concatenating the password and salt together before hashing could lead to some subtle vulnerabilities, and I'm trying to figure out if this is actually the case.
According to this anecdote, the following should not be used:
hash(salt + password) hash(password + salt)
And instead, something similar to an HMAC, like the following, should be used:
hash(hash(password) + salt)
Even though simple concatenation is vulnerable to length extension, I can't think of a way that could ever be useful to an attacker.
Is there any merit to this anecdote?