如何在 Tomcat 5.5 中实现加盐密码
我的 Web 应用程序依赖于容器管理的安全性，我想知道是否可以使用加盐密码。 据我所知，通过配置 JDBC 或 DataSource Realm 将摘要密码存储在数据库中非常容易，但无法向这些摘要添加盐。
有什么建议么？
编辑：看来我只需要在提问之前再考虑一下；-)
这只是选择谁来进行摘要计算（客户端或服务器）并相应地配置 Tomcat 的问题。
My web application is relying on container-managed security and I'm wondering if it's possible to use salted passwords at all. As far as I can tell it's easy enough to store digested passwords in a database by just configuring a JDBC or DataSource Realm, but there's no way to add a salt to those digest.
Any suggestions?
Edit: it seems I just need to think some more before asking questions ;-)
It's just a matter of choosing who's doing the digest calculation (client or server) and configure Tomcat accordingly.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您要创建并存储摘要，则可以同时创建和存储盐。
您的 auth 表将包含
....
pwdDigest varchar(64), -- 或 int256（如果有的话）
hashSalt int64,
....
然后，根据您使用的身份验证协议，您可以在获取客户端加密的用户名时将 hashSalt 发送到客户端，或者如果您收到明文密码，则使用它来哈希密码。
我不熟悉你所谈论的数据库访问技术，所以如果我错过了要点并且过于简化了答案，我深表歉意。
If you're creating and storing the digests you can create and store the salts at the same time.
Your auth table would contain
....
pwdDigest varchar(64), -- or int256 if you have one
hashSalt int64,
....
Then depending on the auth protocol you're using you either send the hashSalt to the client when you get the username for client side encryption or use it to hash the password if you receive it in clear.
I'm not familiar with the database access technologies you're talking about, so I apologise if I've missed the point and oversimplified the answer.
Tomcat 5.5 和 6.0 不支持 JDBCRealms 和 DataSourceRealms 中的加盐密码。 这是一个已知的错误，建议的补丁似乎工作正常，但尚未被接受。
如果您不想应用补丁，您至少可以将其用作实现示例：
错误 45871 - 支持 DataSourceRealm 中的加盐和消化补丁
Tomcat 5.5 and 6.0 don't support salted passwords in JDBCRealms and DataSourceRealms. It's a known bug, and the suggested patch seems to work fine, but it wasn't accepted yet.
If you don't want to apply the patch you can at least use it as an implementation example:
Bug 45871 - Support for salted and digested patches in DataSourceRealm
JCE 中基于密码的加密根据 PKCS#5 使用盐。 请参阅 http://java.sun .com/j2se/1.4.2/docs/guide/security/jce/JCERefGuide.html#PBEEx 为例。
Passord-based encryption in JCE uses salt as per PKCS#5. See http://java.sun.com/j2se/1.4.2/docs/guide/security/jce/JCERefGuide.html#PBEEx for an example.