Earlier quoted context omitted.
This is actually a pretty interesting question. The answer, at least for Merkle-Damgard hash functions (MD5, SHA-1, SHA-2, etc) is that concatenating (or "cascading") hash functions doesn't really improve the strength of the resulting construction. Merkle-Damgard hash functions look like this: function MD(M, H, C): for M[i] in pad(M): H := C(M[i], H) return H For message M, initial state H, and compression function C…
Ah, so in fact the naive concatenating solution I gave, in addition to being just as easy because the attacker only has to break half of it, is actually even easier because the attacker has two targets to collide with. What about non-concatenative methods? For example, could you do something like "shift and xor". For example, say you have a 4-byte hash function, so that: hash(salt + input) : 0x3AF9 hash(salt + fixedS…
I wouldn't say it's easier. Remember that we need to find a single message that generates a collision under both hash functions. So our strategy is to generate a massive number of collisions for the shorter function and hope that there's one pair of messages in there that collide under the longer function.
> What about non-concatenative methods?
I think this will again boil down to finding a single message that generates a collision under both hash functions. It won't matter too much whether you XOR the hashes or concatenate them.