您将如何向现有密码哈希添加盐？
我有一个哈希密码数据库，在哈希密码之前没有添加盐。 我想在新密码中添加盐。 显然我无法重新散列现有的。
您将如何迁移到新的哈希系统？
I have a database of hashed passwords that had no salt added before they were hashed. I want to add salt to new passwords. Obviously I can't re-hash the existing ones.
How would you migrate to a new hashing system?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
你当然可以。 只需向现有哈希添加盐并再次对其进行哈希即可。 当然，这将要求任何未来的登录都经历相同的过程，这意味着需要调用两个哈希函数，但许多合法模式无论如何都会这样做，因此它的味道并不像您想象的那么糟糕。
对密码加盐是一种防御彩虹表的方法。 在这种情况下，盐不需要是秘密。
http://en.wikipedia.org/wiki/Rainbow_tables#Defense_against_rainbow_tables
你实际上可以看到在文章中，
这与您将使用的方法完全相同。 （不同的哈希函数除外。）
Sure you can. Just add a salt to the existing hash and hash it again. Of course this will require any future logins to go through the same process meaning two hash functions will need to be called but lots of legitimate patterns do this anyway so it doesn't smell as bad as you might think.
Salting a password is an effort to defend against rainbow tables. In this case the salt does not need to be a secret.
http://en.wikipedia.org/wiki/Rainbow_tables#Defense_against_rainbow_tables
You can actually see in the article
Which is the same exact method you would be using. (Except a different hashing function.)
作为快速修复，您可以在数据库中创建一个盐列，当用户登录正确匹配旧哈希时，您可以使用他们输入的密码和盐并创建一个新哈希。
As a quick fix, you could create a salt column in the database, and when a user logs in correctly matching the old hash, you can then use that password that they entered with a salt and create a new hash.
您可以添加一列，其中包含一个标志，显示用户是否具有旧（无盐）哈希值或新（带盐）哈希值。
此时，一个好主意是强制所有用户在登录时更改密码。这样您最终就可以摆脱该列。
You could add a column, consisting of a flag showing whether the user has an old (no salt) or a new (with salt) hash.
A good idea is, at that point, to force all users to change their passwords upon sign in. This way you can get rid of that column eventually.
我处理过涉及多种哈希技术的类似问题。 我还使用了在数据库中编码哈希方法类型的方法（即“alpha”、“beta”、“gamma”、“delta”）。 我用适当的级别标记了所有当前的哈希值。 当用户登录时，我验证了他们的密码并使用更新的方法重新对其进行哈希处理。 我们的密码会在 90 天后过期，因此只需保留 3 个月，直到所有使用旧方法的密码都可以重置。
I dealt with a similar issue involving multiple hashing techniques. I used the approach of encoding a hash method type in the database as well (i.e. 'alpha', 'beta', 'gamma', 'delta'). I marked all current hashes with the appropriate level. As users logged in, I validated their passwords and re-hashed them using the updated methods. Our passwords expire after 90 days, so it was just a matter of holding on for 3 months until all passwords using the old methods could be reset.
这里有一些方法可能适合您.
请记住，您添加到现有哈希中的任何恒定模式都是无用的（该链接上的技巧之一是建议类似的内容）。 不应该有可识别的模式可用于分离盐。
当然，最好的方法是迁移到加盐哈希表。
There are some ways here that may work for you.
Remember, any constant pattern you add into the existing hash is useless (one of the tricks on that link is suggesting something like that). There should be no identifiable pattern that can be used to isolate the salt.
Of course, the best way would be to migrate to a salted hash table.
在数据库中创建一个名为“salted”的新字段，其类型为 true/false（或 DBMS 中的任何等效项）。 将现有哈希值的所有值设置为 false。 每当添加新的加盐哈希时，请将“加盐”字段设置为 true。
然后，您所要做的就是在代码中以不同的方式处理两种类型的哈希值。
这更像是一种通用解决方案，而不是特定解决方案，但它应该可以解决您的问题。
Create a new field in you're database named "salted" with a type of true/false (or whatever the equivalent is in your DBMS). Set all the values to false for the existing hashes. Whenever a new, salted, hash is added, set the "salted" field to true.
Then, all you have to do is handle the two types of hashes differently in your code.
This is more of a general solution than a specific one, but it should solve your problem.
如果您将盐存储在哈希中，则通过检查哈希的长度来确定是否包含盐应该相当简单。 如果没有盐，则仅对密码进行哈希处理，如果有盐，则对密码+盐进行哈希处理。
您的数据库中不需要布尔列。
If you are storing the salt inside the hash, it should be fairly straight forward to determine if a salt is included by checking the length of the hash. If there isn't a salt, just hash the password, if there is a salt, hash the password + salt.
You shouldn't need a boolean column in your database.
存储盐的最佳方法是将盐值嵌入到我刚刚创建的密码哈希+盐中。 我不会将盐字符串附加到哈希的开头或结尾，而是将盐字面意思嵌入到哈希中。
The best way I store my salt is that I embed the salt value within the password hash + salt I have just created. I don't append the salt string to the beginning or end of the hash, I literally embed the salt into the hash.