# What is wrong with simple concatenation in salted password hashes?

I once heard that if implementing a password hashing scheme, simply concatenating the password and salt together before hashing could lead to some subtle vulnerabilities, and I'm trying to figure out if this is actually the case.

According to this anecdote, the following should not be used:

hash(salt + password)


And instead, something similar to an HMAC, like the following, should be used:

hash(hash(password) + salt)


Even though simple concatenation is vulnerable to length extension, I can't think of a way that could ever be useful to an attacker.

Is there any merit to this anecdote?

• None of these constructs are secure, and unfortunately, length extension attacks have nothing to do with it. Please just use bcrypt or scrypt. See this answer for more details. – Stephen Touset Feb 7 '16 at 21:52
• I see information about why those libraries are useful, but I don't see any information about why these are insecure. Perhaps you could explain? (This is actually a theoretical question, I do not currently have need of a password hashing tool). – IanPudney Feb 7 '16 at 22:08
• @IanPudney: All three schemes are insecure against attack on the stored hashes due to being fast enough to compute that they can be brute-forced. I think you are correct in thinking the HMAC variant offers no advantage for password storage (in fact it just seems like confusion that "HMAC is better for signing messages" carried over to passwords), but that does not mean any of them are considered good nowadays. If your anecdote was received recently from a source reputing to know about password security, then that source needs updating. – Neil Slater Feb 7 '16 at 23:04

One difference is that with simple concatenation two different salt-password pairs could lead to the same hash input. For example: H('abcd'||'example@example.com') = H('abcde'||xample@example.com). This cannot happen between your password hashes if you use a constant width salt, but could still happen between your password hashes and those of some other service using the same hash.