2
$\begingroup$

The recent SHA1 collision got me thinking.. why do we always throw out the baby with the bathwater when moving to more modern hashing algorithms?

When GIT was written, they went with SHA1 hashes because MD5 was too old and had verified collisions. It is inevitable that given enough time and effort, any current and future algorithms will have problems and eventually demonstrable collisions.

So why not just choose to combine hashing algorithms, preferably the most modern, with the second most modern? Naturally, the hash length in bits would be longer, but seems to be a better way of future-proofing a system than just "use the best at the time of writing"

Is SHA1 hash concatenated with MD5 hash more or less likely to introduce a collision?

| improve this question | |
$\endgroup$
  • $\begingroup$ Because it's slower, invariably less secure, harder to analytically reason about the security of, involves more code, and doesn't actually save any developer effort to switch to two broken hashes when compared to switching to a non-broken hash. $\endgroup$ – Stephen Touset Feb 25 '17 at 0:46
  • $\begingroup$ There is a post from the bear here that should clear everything up. Funny enough I found it because I looked for MD5 SHA-1 SSL in my internet search as I know it was used in the older SSL protocols. As you can see, the idea is not entirely new nor - unfortunately - very good. $\endgroup$ – Maarten Bodewes♦ Feb 25 '17 at 0:57
4
$\begingroup$

This question is similar to asking whether combining multiple symmetric encryption algorithms is a good idea. Of course it is less likely to get a collision for MD5 and SHA-1 simultaneously compared to just getting a collision for SHA-1. Surprisingly, it is, however, not much more expensive to find a collision to both MD5 and SHA-1 than to find one only for SHA-1, as explained here. Also using two hashes decreases the efficiency because you have to hash everything twice and it becomes more difficult to implement it correctly. Moreover, if you care not only about collision resistance, but also other properties, concatenating two hash functions could even be less secure than using just one of them, as explained here. Overall, it seems to be a better idea to just use one good hash function.

| improve this answer | |
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.