Combining two hashing functions I have been working on a Bloom Filter implementation recently and after a discussion with a co-worker about how many hashing functions to use I told him I was limited with using hashing functions that are already implemented and didn't want to risk the loss of distribution if I derive hashing functions from them.

We can assume that the distribution of any hashing function is not 100% perfect. It's very good for many, but not perfect. Is there any existing literature that describes the loss of distribution? I am not using the hashing functions for cryptographic purposes directly, because in a bloom filter it's only used as an index, and it's the distribution is the most important for my needs - but I assume they are related.
For the purposes of a bloom filter you need a number of hash functions. Cryptographic hash functions are designed so that changing a single bit in the input should change many (around 1/2) of the output bits.

So, say you have a good hash function $h$ (e.g., SHA256 though MD5 should work for your purposes too) a good option for you would be to use use:

$h_1(m)=h("1" || m)$
$h_2(m)=h("2" || m)$
$\vdots$
$h_n(m)=h("n" || m)$  

Where $||$ is concatenation. Then you only need one hash function. This is basically what they are doing in this java implementation.


  Is there any existing literature that describes the loss of distribution?


Not that I am aware of. But think about it this way, if there were a significant change from the uniform distribution computable in a reasonable amount of time we wouldn't use the hash function for cryptographic purposes.

Now, is there some sort of attack you are worried about?