why is it bad to double hash a string (encrpyt)?

Question

i heard on another site that doing something like is a bad idea:

$string = "hello";
sha1(hash("sha512", $string));

... as far as i am concerned its a good, clever idea! why is it not? (i did not quite understand the explanation on the other site)

Thanks

Can you link a reference to where you read it? Maybe we can provide some context. Multiple rounds of hashing is not uncommon. If done with a slow algorithm it creates a kind of rate-limit against brute-force attacks. — Michael Berkowski, Feb 14 '13 at 21:47
this is the site http://phpacademy.org/forum/, but annoyingly its under some technical issues — Caspar Wylie, Feb 14 '13 at 21:48
http://stackoverflow.com/questions/348109/is-double-hashing-a-password-less-secure-than-just-hashing-it-once - almost duplicated — Parimal Raj, Feb 14 '13 at 21:49
One advantage is that the hash will most likely not be in any lookup table with known hashes. — John Willemse, Feb 14 '13 at 21:49
@CasparWylie Read over the question linked by AppDeveloper. Good answer there... — Michael Berkowski, Feb 14 '13 at 21:50
Let me know if this helps: http://stackoverflow.com/questions/8066215/hashing-a-string-for-use-in-hash-table-double-hashing/8102118#8102118 — Sumoanand, Feb 14 '13 at 21:51

score 3 · Answer 1 · answered Feb 14 '13 at 21:50

3

There's nothing wrong with hashing multiple times. There are a number of cases where this is actually a good idea.

You want to slow down brute force attacks.
You have a databases full of hashed passwords that use a broken hashing scheme. Upgrading from MD5 to SHA1 for example.
You're implementing a challenge/response scheme.

answered Feb 14 '13 at 21:50

Spencer Ruport

what do you mean "You're implementing a challenge/response scheme."? – Caspar Wylie Feb 14 '13 at 21:57
@Caspar If you want to verify that someone has the same key or salt that is stored on the server, the server could hash a randomly generated message using that key/salt and send it to the client. The client would then use the key/salt to hash the hash and send back the double hash. The server would then hash the original hash with the key again to compare that it matches what the client sent. – Eric Feb 14 '13 at 22:16

score 1 · Answer 2 · answered Feb 14 '13 at 21:50

1

The example you pasted is bad because you're hashing a 512-bit hash with a 160-bit hash.

answered Feb 14 '13 at 21:50

Eric

It's probably just a quick and dirty example, rather than actual code the OP is using. – Aurelia Peters Feb 14 '13 at 21:51

2 Answers2