Double hashing security

Question

My first question is, I've heard that hashing the string 2 times (e.g. sha1(sha1(password)) ), because the second hash has a fixed length, is it true??

My the second question is, which is safer? (var1 and var2 are 2 strings):

1. sha1(var1 + sha1(var2))
2. sha1(var1 + var2)

If it is the 1st one, is it worth the performance cost?

Answer 1

Hashing a string multiple times will complicate the task of the attacker in case of a dictionary attack, making it "much longer" to brute force. Your first question is not clear, but multiple hashes are not less secure because the second hash has a fixed length.

But more important than a multiple hash, the use of a salt is essential for a better security.

Concerning your second question, I would say that it is not very straightforward to say which of the 2 is the safest, I think going with the option 2 is really enough.

Answer 2

My feeling about this is that you're building a brick wall with a steel door, but the other walls are made of plywood. In other words, you can inject as much security as you want into hashing passwords, but there are still going to be much easier ways to crack your system. I think it's much better to take a broad approach to security instead of worrying too much about things like this.