# Are there any known security issues when doing the following chaining of BCrypt Hashes: 'bcryt(bcrypt(user-pw, work-factor1), work-factor2)'

I am currently developing a protocol which would be able to "upgrade" the strength of a bcrypt password hashes without the knowledge of the user-password so a system may upgrade it without user interaction.

Bcrypt requires the password as input to calculate the hash, if you already have a hash, there is no way to "calculate some more rounds" to increase the work-factor (see here).

## Example

So the idea is to just chain the bcrypt hash with a stronger work-factor und using the old bcrypt hash as input like:

bcryptHashOld = bcrypt(pw, 4);
bcryptStronger = bcrypt(bcryptHashOld, 10);


Which would be the theoretical strength of 2^4 = 16 and additionally 2^10= 1024 => 1040 iterations.

Is there any issue with this protocol, ie. hashing the hash WITHOUT the user password? Does the work-factor increase as I have shown in the example above?

## Theoretical Problem Statement

As SEJPM added in the comment a better problem statement would be: "whether chaining two PRFs yields another PRF and whether this chain can be evaluated using less work than two successive PRF calls. In formulas: Whether $$F_{k1}(F′_{k2}(m))$$ is a PRF that requires evaluations of $$F$$ and $$F′$$ to be evaluated"

(Note: I'm not asking how to increase the work factor, but if this approach is cryptographically sound)

• From a theoretical point of view this question is equivalent to asking whether chaining two PRFs yields another PRF and whether this chain can be evaluated using less work than two successive PRF calls. In formulas: Whether $F_{k_1}(F'_{k_2}(m))$ is a PRF that requires evaluations of $F$ and $F'$ to be evaluated.
– SEJPM
Dec 18 '18 at 17:03
• In terms composition of hashing, we have already had two question and answers; 1 2 Dec 18 '18 at 17:15
• Well, the answer is simple, but not Cryptography. In the upgrade stage, when user login first time, they send you their password, so check with old, then migrate to new style while the system has the password. Dec 18 '18 at 17:34
• @kelalaka Thanks for the input, but I am not really interested in the collision resistance but as SEJPM stated, "whether this chain can be evaluated using less work than two successive PRF"; I am also aware of lazy upgrading the hash, but that is not the approach Im investigating. Dec 18 '18 at 18:39