Optimal way to bind two hashes Currently I have:

H1 = SHA256

H2 = SHA1


Both H1 and H2 have fixed length. What's the most efficient way to bind H1 and H2 together into H3? The goal is to maximize protection in case when one of them leaks.

For example:


H3 = H1+H2
H3 = SHA512(H1+H2)
H3 = ???


Length preserving is not needed. This should be calculated instantly so no KDF.

Thanks for your help.

EDIT: I plan to use it as password creation scheme. H1 and H2 should not be changed.
If H1 becomes known then the first part of H3 becomes known if you just concatenate, so that's not a good option.

A simple XOR could work as long as H2 remains secret to an attacker. However, if info about H3 can be retrieved by an attacker and H1 can be changed then the attacker can force H3 to a certain value. But XOR doesn't expand the hash value as you seem to require.

If H1 and H2 are hashed together, e.g. with a larger output hash then all the attacker can do is to try and change H1 until some kind of structure appears in H3. This is the best thing to do if you just rely on hash functions.



You state that you don't require a KDF because you're not dealing with passwords. This is however not a good argument; there are also KBKDF's that derive output key material from input key material (and do not deal with passwords).

HKDF is a KDF that does this: it takes input key material, extracts the entropy from H1 and H2 into a certain intermediate key material, and finally expands the key material to the requested size. So the most fireproof way of creating H3 is: H3 = HKDF(enc(H1, H2), "H3", outsize). Optionally you can also supply a salt or change the label ("H3") to create different output values. enc is an encoding of the values H1 and H2, it can be just concatenation if the size of H1 and H2 can never change.

HKDF just relies on HMAC, and HMAC just relies on a secure hash function. So it can generally be implemented even if it is not directly available.



But just SHA-512 will also work.