1
$\begingroup$

When using two hash functions, g(x)=SHA-512 and f(x)=MD5 g(x) has 512 bit output (using salt) f(x) has 128 bit output.

Let's say that z(x)=f(g(x)) meaning the output is 128 bit long.

The Question: Is using z(x) like using MD5 with salt? Hence, the security level is low. Opposed to using only g(x) with salt and getting 512 bit long output?

On the one hand z(x) is a more complex function than g(x) but on the other hand 512 bit should take longer time to crack vs 128 bit.

|improve this question
$\endgroup$
  • 2
    $\begingroup$ What security property are you after? Should this be a good password hashing scheme? Should this yield a message authentication code? Should this yield a secure hash function (ie collision-resistant, pre-image resistant)? $\endgroup$ – SEJPM♦ Jan 31 '18 at 15:57
  • $\begingroup$ Looking for customer ID anonymization function that is irreversible as possible. $\endgroup$ – Liran Jan 31 '18 at 20:33
0
$\begingroup$

z(x) is equivalent to f(x) for your use case. MD5 has known collision vulnerabilities, so your overall output will suffer from the same vulnerabilities. Also since the output is 128 bits long it is discarding the additional security margin of having a longer hash output.

Using SHA-512 alone is safer. If length extension attacks are an issue either use SHA-512/256, SHA3, Blake2b, HMAC, or another secure hash function immune to such attacks.

|improve this answer
$\endgroup$
  • $\begingroup$ While it is true that the weakness of MD5 could be a problem here, it is not immeadiatelly clear how a collision attack (or even secend preimage attack) against MD5 could be leveraged in an attack against the combined function. $\endgroup$ – Maeher Feb 1 '18 at 5:16
  • $\begingroup$ No, but it still makes me very, very wary about using it. Just because I can't instantly see how to attack it doesn't mean there aren't attacks. I'll always recommend avoiding known-weak primitives even if they can be used in a safe manner, as long as a safe alternative exists. $\endgroup$ – SAI Peregrinus Feb 1 '18 at 15:32
  • $\begingroup$ Oh, I agree with you that it should not be used. This hash function combiner is not robust and there is no way to prove that any of SHA-512's security is retained. But the statement "z(x) is equivalent to f(x)" is too strong without a supporting argument. $\endgroup$ – Maeher Feb 1 '18 at 16:03
  • $\begingroup$ It depends on how it is used in the application. I agree that it can be too strong for some designs, but if an attacker can submit a hashed value then z(x) is MD5(attacker input), and thus equivalent to f(x). Since I don't know the details of the application I assume the strongest attacker. $\endgroup$ – SAI Peregrinus Feb 1 '18 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.