# Can chaining hash functions reduce security?

Is there a concrete case where chaining cryptographic hash functions reduces security?

I'm thinking of things like md5(md5(x)) or sha256(sha1(x)), as common in password hashing (even though neither function above is suitable for it).

• Certainly. You can break sha256( fnv1a(m)) with ease. Mar 5 '17 at 22:03
• @Thomas fnv doesn't seem to be a cryptographic hash function tools.ietf.org/html/draft-eastlake-fnv-12#section-7.1 Mar 5 '17 at 22:08
• An obvious limitation is that breaking the collision resistance of the inner has breaks the collision resistance of the combined hash. (The outer hash is less critical, it'd require a statistical weakness not just a cryptographic attack for it to break the combined hash) Mar 5 '17 at 22:09
• @CodesInChaos Couldn't collision resistance be weaker than that? If you get a collision in the outer hash, I mean. Mar 5 '17 at 22:11
• You have to define "security": is "availability" something you are concerned with? Mar 5 '17 at 23:53