First use md5 and then use sha1. Will the password be safer?

Ask, If I transcode this way, is it more secure. For example: sha1 (md5 (password) I want to know: 1 is necessary. 2. if so, will it have a great impact on performance or what else I can't think, what problems may occur in the future, etc. I hope you can get a reminder and learn! Ask, If I transcode this way, is it more secure.
For example: sha1 (md5 ("password "))
What I want to know is:
1. Is this necessary?
2. If so, will the performance be greatly affected?
Or other things I don't think of, and problems may occur in the future, etc. I hope to hear from you! Reply: It seems that you do not know what salt is. Generate a random number, which is called salt, and record salt and h = hash (pwd + salt) in the database. Obtain the user's password p during query, then, find out the salt from the database and calculate the hash (p + salt). If it is equal to h, It is correct. If it is not equal to, it is wrong.

The reason for using MD5 alone is not that it is easy to crack the MD5 method. In fact, there is no good method for MD5 to retrieve the original image or the second original image, that is, "Inverse Calculation. You can only know the correspondence between multiple MD5 values through pre-calculation, which are stored in the database and then used for reverse query. For example, I know that the MD5 value of 'Password' is 5f4dcc3b5aa765d61d8327deb882cf99, then I will use a data inventory. As long as I see 5f4dcc3b5aa765d61d8327deb882cf99, I will know that this is the value after the password 'Password' is processed using MD5. The original password is 'Password '. It has been a long time since MD5 was used for password protection in the identity authentication system. Most hackers have prepared databases for reverse lookup for this Hash method, which is called a rainbow table.

Therefore, to combat the rainbow table, we need to avoid pre-calculation, so that attackers cannot (or are very difficult) Calculate the rainbow table in advance.

To reflect why rainbow table computing is feasible, let's take a look. Assume that the user may enter lowercase letters and numbers on the keyboard, 26 + 10 = 36 types in total, the reason for this assumption is that a system with many users always has some weak password users. We assume that the entered password must contain at least five characters and a maximum of 12 characters, user input may include:
The possible combination of 12 bytes should be
Type. If the user enters some existing words or phrases for convenience, the input may be far less than the input. If user input is missing, the enumerated space is provided.

To prevent such enumeration, the add salt method is a simple and effective way to expand user input and generate a random number of 16 bytes at random, with up to 12 characters of passwords entered by the user, there is a possibility that no organization or organization can store rainbow tables of such a large scale.

Another method is to increase the Hash complexity and prolong the time consumed by attackers for brute force cracking. Currently, it is too easy to use the video card for Parallel Computing. The 6-digit pure digital password seems to be a second break in the video card. Multiple iterations of the Hash algorithm are the simplest way to prolong the computing time. Apache's htpasswd uses 1000 iterations of MD5, but it makes these passwords slightly difficult to crack.

In addition, the SHA1 and MD5 algorithms are used in the question. In addition to slightly improving the computing difficulty, this combination method cannot increase the possibility of user input, in addition, although SHA1 generates a 160-bit Hash, the output is only possible because the input is a 128-bit MD5, and the scope of the guess is not reduced. So this is why I suggested you use more times (such as 1000 times) for MD5 iterations. At least one aspect should be slightly enhanced.

In addition, this article (the brute force password cracking tool ocl-Hashcat-plus allows you to guess a maximum of 8 billion passwords per second. What does it mean ?) Data is available for reference. bcrypt is an effective algorithm for password Hash cracking. We recommend that you use it. Salt is used to prevent attackers from directly using the pre-computed md5 dictionary to match the ciphertext to find the plaintext, because if the user password is an entry in the dictionary, it will hardly appear in the dictionary after a random suffix is added, attackers cannot construct a rainbow table.
The subject can still be attacked by rainbow tables. The attacker only needs to know your algorithm and create a new sha table for the rainbow table constructed by a single md5. If the plaintext itself is an entry in the table, the attack is very difficult. This was already written in the CSDN brute-force database:
Http://blog.sina.com.cn/s/blog_77e8d1350100wfc7.html

As mentioned above, the function of adding salt is to avoid Precalculation of rainbow tables. This is the correct explanation. Do not associate salt adding with complex passwords. Although there is actually such a side effect, the principle of salt adding is not at all. This misleading will lead to some inexplicable "adding salt" ignorance.

In addition, the idea of SHA (MD5 (password) or MD5 one thousand times is often inexplicable. These questions have been answered in my blog and I will not go through them here. It would be useless if the data was leaked, and salt was also seen you could use SHA-2 directly.

However, we should say that hash algorithms, such as MD5 and SHA1, are not encryption algorithms. Because the result after encoding is irreversible, unless you use the exhaustive code. Do not use SHA or MD5 any more, or add salt. Use Bcrypt First, I declare that I am not specialized in cryptography.
For common applications, adding Salt is enough. It is recommended that you check @ sumtec's lack of knowledge. It is terrible-MD5 + Salt is not safe in the joke of applying cryptography _ sumtec _ Sina Blog MD5 + salt prevents the original rainbow table from hitting the database. However, as the computer performance improves and the algorithm complexity is insufficient, the database can be cracked by brute force hitting the database.
I think sha256 + salt algorithms are required if security requirements are high.
This is a scenario where passwords are stored in general databases.

I am also looking for information on the performance consumption of these algorithms... The original password is md5 no salt is not safe, in thinking how to solve the direct sense of sha-3 and Adding Fixed salt is almost a one-to-one correspondence relationship, adding salt can increase the larger cost;