Search code examples
securitypassword-encryption

Double hashing security

My first question is, I've heard that hashing the string 2 times (e.g. sha1(sha1(password)) ), because the second hash has a fixed length, is it true??

My the second question is, which is safer? (var1 and var2 are 2 strings):

  1. sha1(var1 + sha1(var2))
  2. sha1(var1 + var2)

If it is the 1st one, is it worth the performance cost?

Solution

  • By hashing the string twice, you are increasing the risk of collisions, which is bad security-wise.

    Instead of having an infinite amount of inputs leading to 2128 possible outputs, you will have 2128 possible inputs leading to maybe less than 2128 outputs.

    Using salt and pepper before hashing at least keeps the input to infinite possibilities. Hashing twice increases the run time of your script, and increases the risk of collisions, unless you maintain the source of infinite input.