加密/解密与MySQL数据库之间的密码

I'm starting to create a user system for my website, and what I want to do is to have the passwords encrypted, rather than plaintext. I'm using PHP/MySQL, so I figured crypt() is a good place to start. However, I'm brand new to cryptography like this, and I'm having trouble understanding exactly how it works. Does anybody know how to implement, at the simplest level, a way for passwords to be stored as an encrypted string, but always be able to be decrypted, without a security issue?

我开始为我的网站创建一个用户系统,我想要做的是加密密码,而不是明文。我正在使用PHP / MySQL,所以我认为crypt()是一个很好的起点。但是,我对这样的密码学并不陌生,而且我很难理解它是如何工作的。有没有人知道如何在最简单的层面上实现密码存储为加密字符串的方式,但总是能够解密,没有安全问题?

7 个解决方案

#1

Passwords should be hashed, not encrypted. That is, you should not be able to decrpyt the password. Instead, you should compare hashes.

密码应该经过哈希处理,而不是加密。也就是说,您不应该删除密码。相反,你应该比较哈希。

User sets password $password = 'hX4)1z'

用户设置密码$ password ='hX4)1z'

You get hash of password and store to DB:

您获得密码哈希并存储到DB:

#

$pw = hash_hmac('sha512', 'salt' . $password, $_SERVER['site_key']);
mysql_query('INSERT INTO passwords (pw) VALUES ('$pw');

Customer comes back later. They put in their password, and you compare it:

客户稍后回来。他们输入了密码,你比较一下:

#

mysql_query('SELECT pw FROM passwords WHERE user_id = ?');
//$pw = fetch

if ($pw == hash_hmac('sha512', 'salt' . $_REQUEST['password'], $_SERVER['site_key']) {

   echo "Logged in";

}

#2

PHP has some built-in has functions, such as md5(). When I was learning I found IBM's primer very useful - I'd highly recommend looking at that.

PHP有一些内置的函数,比如md5()。在我学习的时候,我发现IBM的入门非常有用 - 我强烈建议你这样做。

As an aside, I would advise against being able to decrypt a password. The only person who should know their password is a user! This is why we store hashed versions of passwords which we can check against, rather than storing encrypted passwords which can be decrypted..

顺便说一句,我建议不要解密密码。唯一应该知道密码的人是用户!这就是为什么我们存储我们可以检查的密码版本的密码,而不是存储可以解密的加密密码。

#3

I notice people make huge deals about storing passwords.

我注意到人们在存储密码方面做了很多交易。

Agreed you shouldn't store passwords as plain texts, but if you store the one way hash and get rid of the password, hackers can still using algorithms to hack a hash hashing strings and comparing.

同意你不应该将密码存储为纯文本,但如果你存储单向散列并删除密码,黑客仍然可以使用算法来破解哈希散列字符串并进行比较。

Also, if you encrypt with an algorithm that you can decrypt later, that can also be hacked by figuring out the algorithm of the encryption.

此外,如果使用可以在以后解密的算法进行加密,也可以通过计算加密算法来进行攻击。

I think as long as no one can see the users' passwords outright and you simply make it difficult for hackers you're good, but people say you shouldn't encrypt because it can be decrypted but that's not fair because anything can be hacked.

我认为,只要没有人能够直接看到用户的密码而你只是让黑客难以为好,但是人们说你不应该加密,因为它可以被解密,但这是不公平的,因为任何东西都可以被黑客入侵。

#4

Use md5 instead

请改用md5

http://php.net/manual/en/function.md5.php

http://en.wikipedia.org/wiki/Md5

#5

You can use md5 or better hashing technique like sha1 See password hashing http://phpsec.org/articles/2005/password-hashing.html for more details.

您可以使用md5或更好的散列技术,例如sha1请参阅密码散列http://phpsec.org/articles/2005/password-hashing.html以获取更多详细信息。

#6

I suggest using SHA2 with a salt to store your password.

我建议使用带盐的SHA2来存储密码。

To create a SHA2 hash, use this:

要创建SHA2哈希,请使用以下命令:

$hash = hash("sha512", $password.$salt);

A salt contains some extra characters to add to your password before hasing to prevent rainbow tables (databases of passwords and it's hashes). You can create one using a unique user info (like a user_id) or just create a random one and store it somewhere. Just make sure the salt is long enough.

在为了防止彩虹表(密码数据库及其哈希值)之前,盐包含一些额外的字符要添加到您的密码中。您可以使用唯一的用户信息(如user_id)创建一个或只创建一个随机的用户信息并将其存储在某个地方。只要确保盐足够长。

Don't make use of MD5 anymore; it's old. See http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities for more info.

不要再使用MD5了;它太旧了。有关详细信息,请参阅http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities。

EDIT: These are one-way hashing algoritms. You can and should not be able to decrypt a password. If you can, then there is no point in using a hash to store passwords.

编辑:这些是单向散列算法。您可以而且不应该能够解密密码。如果可以,那么使用哈希来存储密码是没有意义的。

#7

No, there is always going to be a security issue with regards to where you store the encryption password. This is why websites never store the hash of the password and not the password itself. When someone registers at your website and they enter the password, you store the hash (MD5 or SHA1 or whatever, as mentioned above) of the password. When they log in later you again hash the password they entered (by the same method used when storing it) and compare. If the hashes are the same then the passwords are the same (with a very high probability!) Any website that lets you recover your password is an insecure website.

不,存储加密密码的位置始终存在安全问题。这就是为什么网站永远不会存储密码的哈希值而不是密码本身。当有人在您的网站上注册并输入密码时,您将存储密码的哈希值(MD5或SHA1或其他任何内容,如上所述)。当他们稍后登录时,再次哈希他们输入的密码(通过存储时使用的相同方法)并进行比较。如果哈希是相同的,那么密码是相同的(很有可能!)任何允许您恢复密码的网站都是一个不安全的网站。

#1