让md5变得强大
我正在制作一个与仅支持 md5 哈希方法 (atm) 的游戏集成的网站。哪个 ofc 不再特别安全了。但我怎样才能让它变得更强呢？我应该生成一长串随机字母和数字并对它们进行哈希处理吗？但是用户必须将密码保存在计算机中的 paper/txt 文件中。
你有什么建议？
Im making a website that will intergrate with game that only support md5 hashing metod (atm). Which ofc is not especially safe anymore. But how could i make it stronger? Should I just generate long strings of random letters and numbers and hash them? But then the users have to save the password on a paper/txt file in computer.
What do you suggest?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
对于你正在做的事情来说，md5 哈希值有什么问题？向其添加更多随机字符不会产生太大影响。
您可以查看 SHA 哈希，以获取 md5 的替代方案。
What is wrong with an md5 hash for what you are doing? Throwing more random characters at it won't make much difference.
You can take a look at SHA hashes for an alternative to md5.
md5 的缺点有点被夸大了，但您可以使用 sha512 代替。这是一种更好的哈希算法。
The weaknesses of md5 are a little over-hyped, but you can just use sha512 instead. It's a better hashing algorithm.
虽然 MD5 由于其弱点而并不是最好的哈希算法，但这完全取决于您正在做什么。如果这是您唯一的选择，并且您希望在将密码存储到数据库之前对其进行哈希处理，请务必这样做。
您说 MD5 是您“目前”唯一的选择。这是否意味着您以后可能会有其他可用的哈希算法？现在考虑使用 MD5，但给自己留出使用其他算法的升级路径。
您可能需要考虑将盐与 MD5 结合使用。这将有助于防御某些攻击（例如彩虹表）。
While MD5 isn't the best hashing algorithm out there due to its weaknesses, it all depends on exactly what you're doing. If it's your only option and you want to hash passwords before storing them in the database, by all means do so.
You said that MD5 is your only option "at the moment". Does this mean you might have other hash algorithms available later? Consider using MD5 for now but leave yourself an upgrade path to use other algorithms.
You may want to consider using a salt in conjunction with MD5. This will help defend against some attacks (e.g., rainbow tables).
如果用于密码散列，请考虑使用加盐散列，而不仅仅是对密码进行暴力散列。 查看维基百科
如果密码是用户选择的，请考虑设置密码强度指示器并也防止他们使用过于简单的工具。一件好事是检查它们至少是大/小/数字中的两个，并通过 clanglib 运行它们，如果失败，则拒绝设置密码。
除此之外，你一切都还好。
If it's for passwords hashing, consider using salted hash instead of just brute hashing the password. See Wikipedia
If the password are user chosen, consider having a password strength indicator and also prevent them to use too easy one. One good thing is to check they are at least two of either upper/lower/numbers and run them through cracklib and if they fail that, refuse to set the password.
Other than that you're pretty much OK.
您到底对什么进行散列以及如何使用散列？
您是否有机会存储帐户密码以进行网站身份验证？密码散列的弱点是由于以错误的方式使用散列（任何散列）造成的，而不是由固有的散列算法的弱点造成的。没有人会暴力破解您的 MD5 哈希，问题将是针对已知哈希值（彩虹表）的字典攻击。保护措施是使用 HMAC 哈希值或类似的值，例如“加盐”哈希值。
如果您认为使用不同的哈希算法会给您带来任何好处，那么恐怕您就走错了路。虽然SHA1或SHA256确实具有更强的加密属性并且可以更长时间地承受暴力攻击，但如果使用不正确，即使是最强的哈希也将毫无用处。另一方面，如果使用得当，MD5 也能正常工作。
What exactly do you hash and how you use the hash?
Are you refering by any chance to storing account passwords for authentication with the site? The weackness of password hashing are caused by using the hash (any hash) in a wrong manner, not by inherent hashing algorithm weakness. Nobody is going to brute force your MD5 hash, the problem will be dictionary attacks agains known hash values (rainbow tables). And the protection is to use an HMAC hash, or something similar, like a 'salted' hash.
I'm afraid you're on the wrong track if you consider that using a different hashing algorithm will give you any benefit. While is true that SHA1 or SHA256 have stronger cryptographic attribute and will stand a brute force attack for longer time, even the stronges hash will be useless if incorrectly used. On the other hand MD5 will work just fine when used properly.