Attention cryptographers: brilliant insights available at El Reg!
Ah, how nice to see the Reg readers are as inclined as ever to contribute to the discussion, even if it's of a highly-technical subject they haven't studied. If only these bleedin' obvious ideas had been considered by actual experts in the field!
Chris C: Using two hashes does not offer a high probability of significantly improved security against most attacks, particularly when the hashes come from the same family of compression functions, as is the case with MD5 and SHA-1. As Tom Jones pointed out, you now have a construction Hnew(m) = H1(m) | H2(m). That's sometimes vulnerable to parallel attacks on both hashes. Even if it isn't, then if H1 and H2 have close to the same work factor for a given attack, then Hnew has twice that work factor - so you've effectively built a hash that's one bit longer than what you had before. Better to simply switch to SHA-256 and expand the search space by 2**96.
And *of course* people assume that attackers have access to large distributed networks, for attacks that can be parallelized. Do the math. A naive collision attack on SHA-1 requires trying on average 2**80 preimage pairs (so computing 2**81 hashes). This new attack requires 2**53 hashes on average to find a collision. If you have a network of a thousand machines that can each do about a million hashes (and generate the preimages, and compare the results) a second, that's about 2**30 pairs per second. With that grandiose a botnet running flat out, you'd find a collision in about 100 days. Whoopie. You'd do a lot better with custom hardware - the Hash Collision FAQ suggests that custom ASICs might be able to do on the order of 10**9 hashes per second. Get around 10,000 of those going and you'd find a collision in about 3 hours.
Of course, that's just a collision, which greatly limits your opportunities for interesting attacks. (The "two contracts" scenario is the textbook example, but you have to find some idiot willing to take you up on it.)
Bounty: This is about hash collisions, not encryption. Though the chance of your scheme offering any real additional security is pretty low, too. A successful attack against AES might well apply to the other cipher. But more importantly, attacking the cipher is very rarely how encryption is broken these days. Much easier to attack side channels, sources of key information, or people.
AC: Salting protects against precomputed-dictionary attacks and some traffic analysis ("I don't know what this message is, but I know I've seen it before"). It does nothing to resist finding hash collisions.
Crypto attack puts digital sig hash on collision course
