On Thu, Apr 03, 2008 at 06:14:17PM +0200, Svenne Krap wrote:
> Hashes are an absolute minimum for keeping passwords stored somehat
> safely in a database.
> More two or even three different hashes with different collion-points
> will strongly increase the security.
Not only that, but they also increase the complexity of the system.
Increases in complexity tend to mean decreases in reliability and,
by implication, security. As an example, someone may do some fancy
cryptanalysis and discover that having lots of hashes will actually make
it easier. As another point, most passwords have significantly less
state than a 128bit hash allowing attacks like rainbow tables become
viable.
Sam
