“盐”的目的是什么？什么时候散列？
好吧，我想了解使用盐的原因。
当用户注册时，我会为他/她生成一个独特的盐，并将其存储在数据库中。然后我使用 SHA1 对它和密码进行哈希处理。当他/她登录时，我使用 sha1($salt.$password) 重新哈希它。
但如果有人入侵我的数据库，他可以看到散列密码和盐。
这比不加盐的哈希密码更难破解吗？我不明白……
对不起，如果我愚蠢的话……
Ok, I’m trying to understand the reason to use salt.
When a user registers I generate a unique salt for him/her that I store in DB. Then I hash it and the password with SHA1. And when he/she is logging in I re-hash it with sha1($salt.$password).
But if someone hacks my database he can see the hashed password AND the salt.
Is that harder to crack than just hashing the password with out salt? I don’t understand …
Sorry if I’m stupid …
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您不使用盐，那么攻击者甚至可以在侵入您的服务器之前离线预先计算密码<->哈希数据库。添加盐会大大增加数据库的大小，从而使执行此类攻击变得更加困难。
此外，一旦他们闯入，他们就可以猜测常用的密码，对其进行哈希处理，然后检查数据库中的所有密码是否匹配。每个用户使用不同的盐，他们一次只能攻击一个密码。
维基百科上有一篇关于密码学中的盐的文章。
If you don't use a salt then an attacker can precompute a password<->hash database offline even before they've broken into your server. Adding a salt massively increases the size of that database, making it harder to perform such an attack.
Also, once they've broken in they can guess a commonly used password, hash it, and then check all of the passwords in the database for a match. With a different salt for each user, they can only attack one password at a time.
There's an article at Wikipedia about salts in cryptography.
使用盐的另一个目的是确保具有相同密码的两个用户最终不会在用户表中具有相同的哈希值（假设他们的盐不同）。但是，盐和密码的组合最终可能会导致相同的“字符串”或哈希，并且哈希将完全相同，因此请确保使用盐和密码的组合，其中两个不同的组合不会导致相同的哈希值。
Another intention behind the use of a salt is to make sure two users with the same password won't end up having the same hash in the users table (assuming their salt are not the same). However, the combination of a salt and a password may lead to the same "string" or hash in the end and the hash will be exactly the same, so make sure to use a combination of salt and password where two different combination won't lead to the same hash.
如果攻击者创建明文密码的哈希值巨型表，则使用盐可以防止他使用同一张表破解多个密码。攻击者必须为每种盐生成一个单独的表。请注意，为了使其真正正常工作，您的盐应该相当长。否则，攻击者的预先计算表很可能包含盐+密码哈希值。
If an attacker creates a giant table of hash values for plaintext passwords, using a salt prevents him from using the same table to crack more than one password. The attacker would have to generate a separate table for each salt. Note that for this to actually work propertly, your salt should be rather long. Otherwise the attacker's precomputed table is likely to contain the salt+password hash anyway.