Cryptography question: is it bad (as in, does it introduce a vulnerability) if a single hash is verified using two different algorithms? Like this:

if (algo1.verify(password, hash) || algo2.verify(password, hash)) {
  //...
}

My gut instinct is that this is
bad, but I'm not exactly sure why, and that makes me hesitant to include it as a finding in this audit. I'd appreciate any input from my cryptography friends! ​:neofox_heart_blue:

0

If you have a fediverse account, you can quote this note from your own instance. Search https://enby.life/notes/agedm03017 on your instance and quote it. (Note that quoting is not supported in Mastodon.)