Can I md5(sha1(password))?

Question

I\'m currently coding my own CMS and I\'m at the state of password...

I want to know if I can md5 a password then sha1 it after?

Li

Answer 1

Yes you can. No it doesn't make sense.

The security of chained hash functions is allways equal to or less than the security of the weakest algorithm.

i.e. md5(sha1($something)) is not more secure, than sha1($something): If you manage to break the sha1, you get the md5 for free, as shat($something) and sha1($faked_something) have the same value, and thus md5ing them will not change anything.