0
$\begingroup$

Background

Hashing files is an expensive thing for CPU. I am tasked to write a secure digital signature scheme. For that, I decided to check the integrity of files using Hash/Digest.

To be more secure, my plan is to use two or three hashes instead of one. Rough diagram looks like following.

Generating Hash which will be signed by a private key

[plain.txt] ---- algoX ----> [sha512(plain.txt) + sha256(plain.txt)]

Verifying Hash

Calculate sha512, sha256 of plain.txt and verify it by matching with the output of algoX. Verify is OK if and only if all hashes match.

Postscript

I know that it is as hard as most difficult hash, but will it yield significant security improvement keeping in view the expense of hash calculations.

What are possible attacks which can be carried out against this type of scheme?

Improve this question
$\endgroup$
3
  • $\begingroup$ What's the point? SHA-512 provides around 256 bits of collision resistance. Note that SSL used MD5 + SHA1 but that scheme has been deprecated for a reason. By the way, generally + doesn't mean concatenation. I assume from your description that you do mean concatenation in this case? $\endgroup$
    – Maarten Bodewes ♦
    Jun 30, 2020 at 20:53
  • $\begingroup$ MD5 was once considered secure but it is no more near that. Advantage of using multiple hashes may be that if one gets broken for any reason, second one can hold up for some time. By concatenation, i mean putting these hashes one after another $\endgroup$
    – Eirtaza
    Jun 30, 2020 at 21:40
  • $\begingroup$ Right. The question becomes if it is more secure to simply use a larger hash than two hashes that use a similar scheme concatenated to each other. E.g. you could use SHA-512 and SHA3-512 which rather different schemes. Neither of these schemes is even near broken though (not taking length extension attacks into account for SHA-2). $\endgroup$
    – Maarten Bodewes ♦
    Jun 30, 2020 at 22:15

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.