将盐存储在代码中而不是数据库中
有一对关于盐最佳实践的精彩讨论，似乎压倒性的建议是为每个密码生成不同的盐并将其与密码一起存储在数据库中。
然而，如果我正确理解盐的目的，它是为了减少你受到彩虹表攻击的机会。 因此，我知道通过将其存储在数据库中，最好为每个用户更改它，但是如果盐离数据库很远怎么办？ 如果我在代码中存储单个盐值（该值将在 Web 服务器上的编译 dll 中），那么如果攻击者以某种方式获得对数据库的访问权限，这不会达到相同的目的吗？ 在我看来，这似乎更安全。
There have been a couple of great discussions regarding salt best practices, and it seems the overwhelming recommendation is to generate a different salt for each password and store it alongside the password in the database.
However, if I understand the purpose of salt correctly, it is to reduce the chance that you will be compromised by rainbow table attacks. So, I understand that by storing it in the database it would be optimal to change it for each user, but what if the salt is nowhere near the database? If I store a single salt value in the code (which would on the web server be in a compiled dll), wouldn't that serve the same purpose if an attacker were to somehow gain access to the database? It would seem to me to be more secure.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
盐的价值在于它对于每个用户来说都是不同的。 当您重新创建哈希值以进行比较时，您还需要能够检索此非唯一值。
如果您存储用于每个密码的单个盐值，那么您首先会大大降低盐的价值。
The value of a salt lies in it being different for each user. You also need to be able to retrieve this non-unique value when you're re-creating the hashed value for comparison purposes.
If you store a single salt value that you use for every password, then you massively reduce the value of having a salt in the first place.
盐的目的是要求每个密码重新生成彩虹表。 如果您使用单一盐，黑客/破解者只需重新生成彩虹表一次，他就拥有您的所有密码。 但如果你为每个用户生成一个随机的，他也必须为每个用户生成一个。 对于黑客来说，成本要高得多。 这就是为什么你可以以纯文本形式存储盐，只要有多个盐，黑客是否知道并不重要。
默默无闻的安全性并不好，微软已经告诉我们这一点。
The purpose of a salt is to require the regeneration of a rainbow table per password. If you use a single salt, the hacker/cracker only has to regenerate the rainbow table once and he has all your passwords. But if you generate a random one per user, he has to generate one per user. Much more expensive on the hackers part. This is why you can store a salt in plain text, it doesn't matter if the hacker knows it as long as there's more than one.
Security by obscurity is not good, microsoft has taught us that.
...直到攻击者获得对 DLL 的访问权限。
... until the attacker gains access to the DLL.
除了其他答案之外，还值得注意的是，攻击者可以像计算密码一样计算出您的盐：给定一个已知的密码（他自己的），他可以对可能的盐进行暴力攻击。
In addition to other answers, it's also worth noting that an attacker could figure out your salt in the same way he would figure out a password: Given a known password (his own), he can do a brute force attack on possible salts.
我从盐中学到的教训是：分而治之（安全）
The lesson I learned from salts is: Divide and Conquer (security)