Combining algorithms for password storage? Is it more secure to combine algorithms for password hashing, for example, Scrypt, Bcrypt, SHA-3, etc.? If an attacker wants to use dedicated hardware, he would need one for each algorithm. However, I know having multiple algorithms increases the probability of having bugs and leaks.
If having multiple algorithms for EACH password can create leaks, what about having different algorithms for different passwords: If the attacker only has hardware for Bcrypt, he can't brute force passwords hashed with Scrypt.
EDIT : By combining, I mean, hash2(hash1(hash0(password))). In the second paragraph, I mean hash0(P0), hash1(P1), hash2(P2), hash0(P3), hash1(P4), hash2(P5).
EDIT : What about hash0(P0), hash1(P0), hash0(P1), hash1(P1), ... ?
The combination of different schemes may be somewhat advantageous with regard to certain custom hardware (ASICs), but I think that the disadvantages outweigh them.

I assume that there is some kind of fixed time that is acceptable to the user. Nobody will use a procedure where she or he has to wait several minutes.
Modern password hashing schemes are characterized by the fact that they are not only time intensive, but also memory-hard. To put it simply, a vector is created in RAM in the time acceptable to the user. If less time is available, this vector is smaller. Splitting the acceptable time over several password hashing schemes results in less time to generate the vector for each single scheme. So the whole process becomes less memory-hard.

Password hashing schemes, like all cryptographic procedures, are potentially susceptible to side channel attacks. This applies, for example, to cache timing attacks. Several schemes offer more targets.

And as the questioner has already correctly pointed out, the susceptibility to bugs is greater with several schemes.


I would rather rely on one scheme such as Argon2id and spend all available time to make this method as memory-hard as possible.