Cryptography question: is it bad (as in, does it introduce a vulnerability) if a single hash is verified using two different algorithms? Like this:
if (algo1.verify(password, hash) || algo2.verify(password, hash)) {
//...
}My gut instinct is that this is bad, but I'm not exactly sure why, and that makes me hesitant to include it as a finding in this audit. I'd appreciate any input from my cryptography friends!