如何解密字符串
使用后如何恢复字符串的值 FormsAuthentication.HashPasswordForStoringInConfigFile()
我有一个字符串 s1 = "abc" 然后
FormsAuthentication.HashPasswordForStoringInConfigFile(s1, "SHA1") = A9993E364706816ABA3E25717850C26C9CD0D89D
我如何将“A9993E364706816ABA3E25717850C26C9CD0D89D”解密回“abc”？
How to restore the value of a string after using
FormsAuthentication.HashPasswordForStoringInConfigFile()
i have a string s1 = "abc" then
FormsAuthentication.HashPasswordForStoringInConfigFile(s1, "SHA1") =
A9993E364706816ABA3E25717850C26C9CD0D89D
How can i decrypt "A9993E364706816ABA3E25717850C26C9CD0D89D" back to "abc"??
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
你不能，哈希函数是单向函数。这就是它用于密码的原因，因为您无法对哈希值使用某些反向函数来获取密码。
You Can't, Hash Function are one way functions. this is why it is used for passwords, because that you can't get the password using some reverse function on the hash value.
继Baget的回答之后。对密码进行哈希处理的原因是为了避免您必须存储明文密码以进行身份验证。
相反，您存储密码的哈希值。
您的身份验证/登录过程将变成这样：
用户输入密码。
对他们输入的密码进行哈希处理。
将输入的哈希值与存储的哈希值进行比较。
如果哈希值匹配，则密码有效，因此用户已通过身份验证。
这样做的原因是为了保护用户的身份验证详细信息。因此，如果您的密码文件或数据库确实以某种方式成为公共领域，那么恶意用户就无法冒充真正的用户。
因此，哈希函数的本质意味着它是一种方式，因此无法恢复原始的纯文本。
这就是理论，当然在实践中它会变得更复杂。
大多数用户倾向于使用他们可以轻松记住的密码，因此这意味着您在安全方面所做的所有努力都可能化为泡影，因为如果有人获得了您的密码文件/数据库，然后离线，他们可以构建常用单词字典并暴力迭代和散列直到他们在您的列表中找到匹配的哈希值。
为了避免这种情况，许多人使用“加盐”技术，其中密码在散列之前添加了一个简短的加密“随机”字符串。阅读本文以了解更多详细信息
这里的另一个问题是哈希算法的强度 - 您需要确保你不能创建“碰撞”，即产生相同哈希值的两段明文。
许多旧的哈希算法（例如 MD5 和 SHA1）在这方面看起来越来越容易受到攻击。
MD5 被视为已损坏
SHA1 也被认为已损坏
希望有所帮助，我意识到这可能是一个比你问的要多一些，但我认为人们在实现身份验证代码时了解安全问题很重要
Following on from Baget's answer. The reason you hash passwords is to avoid you having to store the plaintext password for authentication.
Instead you store the hash of the password.
Your authentication/login process then becomes something like this :
User enters password.
Hash the password they have input.
Compare the entered hash against the stored hash.
If hashes match then password is valid so user is authenticated.
The reason this is done is to protect your users' authentication details. So if your password file or database did become public domain somehow then a malicious user couldn't pretend to be a genuine user.
So the nature of the hashing function means it's one way and so the original plain text can't be recovered.
That's the theory, of course in practice it gets more complicated than that.
Most users tend to use passwords that they can easily remember so this means that all your best efforts at security can come to nought because if someone obtained your password file/DB then offline they can build a dictionary of common words and brute force iterate and hash until they find a matching hash in your list.
To avoid this, many people use a 'salting' technique where the password has a short cryptographically 'random' string added to the password before hashing. Read this for more details
The other issue here is the strength of your hashing algorithm - you need to ensure that you can't create 'collision's i.e two pieces of plaintext that produce the same hash value.
Many older hashing algorithms such as MD5 and SHA1 are increasingly looking vulnerable in this regard.
MD5 considered broken
SHA1 also considered broken
Hope that helps and I realise that's probably a bit more than your were asking but I think it's important people understand security issues when implementing authentication code