目前最安全的单向加密算法是什么？
许多人都知道，单向加密是加密数据库中用户密码的一种便捷方法。这样，即使是数据库管理员也无法知道用户的密码，而必须猜测密码，使用相同的算法对其进行加密，然后将结果与数据库中的加密密码进行比较。这意味着破解密码的过程需要大量的猜测和大量的处理能力。
看到计算机变得越来越快，数学家仍在开发这些算法，我想知道考虑到现代计算能力和加密技术，哪一种是最安全的。
多年来我几乎只使用 MD5，我想知道是否还应该做更多的事情。我应该考虑不同的算法吗？
另一个相关问题：这样的加密密码的字段通常应该有多长？我必须承认，我对加密几乎一无所知，但我假设 MD5 散列（作为示例）可能更长，并且可能需要更多的处理能力来破解。或者，如果加密的密码首先适合该字段，那么该字段的长度根本不重要吗？
As many will know, one-way encryption is a handy way to encrypt user passwords in databases. That way, even the administrator of the database cannot know a user's password, but will have to take a password guess, encrypt that with the same algorithm and then compare the result with the encrypted password in the database. This means that the process of figuring out the password requires massive amounts of guesses and a lot of processing power.
Seeing that computers just keep getting faster and that mathematicians are still developing these algorithms, I'm wondering which one is the most secure considering modern computing power and encryption techniques.
I've been using MD5 almost exclusively for years now, and I'm wondering if there's something more I should be doing. Should I be contemplating a different algorithm?
Another related question: How long should a field typically be for such an encrypted password? I must admit that I know virtually nothing about encryption, but I'm assuming that an MD5 hash (as an example) can be longer and would presumably take more processing power to crack. Or does the length of the field not matter at all, provided that the encrypted password fits in it in the first place?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
MD5 早在 1996 年就被发现很弱，不应再用于加密目的。 SHA-1 是常用的替代品，但 有类似的问题。 SHA-2 系列 哈希函数是当前 SHA-1 的替代。 SHA-2 的成员分别称为 SHA-224、SHA-256、SHA-384 和 SHA-512。
目前，多个哈希函数正在竞相成为SHA-3 ，下一个标准化的加密哈希算法。 2012 年将选出获胜者。这些都还不应该使用！
对于密码哈希，您还可以考虑使用 bcrypt。它的设计速度足够慢，使得大规模的暴力攻击变得不可行。您可以自己调整速度，这样当计算机变得更快时，速度就可以变慢。
警告：bcrypt 基于较旧的双向加密算法 Blowfish，目前已有更好的替代算法。我认为 bcrypt 的加密哈希属性还没有被完全理解。如果我错了，有人纠正我；我从未找到可靠的来源从密码学的角度讨论 bcrypt 的属性（除了它的缓慢性）。
令人放心的是，与公钥加密或数字签名相比，密码散列的冲突风险要小一些。如今使用 MD5 对于 SSL 来说是一个糟糕的主意，但对于 SSL 来说却并非同样灾难性的密码散列。但如果你有选择的话，那就选择一个更强的。
使用良好的哈希函数不足以来保护您的密码。您应该将密码与长的盐一起进行哈希处理和加密随机。如果可能的话，您还应该帮助您的用户选择更强的密码或密码短语。时间越长越好。
MD5 was found to be weak back in 1996, and should not be used anymore for cryptographic purposes. SHA-1 is a commonly used replacement, but has similar problems. The SHA-2 family of hash functions are the current replacement of SHA-1. The members of SHA-2 are individually referred to as SHA-224, SHA-256, SHA-384, and SHA-512.
At the moment, several hash functions are competing to become SHA-3, the next standardised cryptographic hashing algorithm. A winner will be chosen in 2012. None of these should be used yet!
For password hashing, you may also consider using something like bcrypt. It is designed to be slow enough to make large scale brute force attacks infeasible. You can tune the slowness yourself, so it can be made slower when computers are becoming faster.
Warning: bcrypt is based on an older two-way encryption algorithm, Blowfish, for which better alternatives exist today. I do not think that the cryptographic hashing properties of bcrypt are completely understood. Someone correct me if I'm wrong; I have never found a reliable source that discusses bcrypt's properties (other than its slowness) from a cryptographic perspective.
It may be somewhat reassuring that the risk of collisions matters less for password hashing than it does for public-key cryptography or digital signatures. Using MD5 today is a terrible idea for SSL, but not equally disastrous for password hashing. But if you have the choice, simply pick a stronger one.
Using a good hash function is not enough to secure your passwords. You should hash the passwords together with salts that are long and cryptographically random. You should also help your users pick stronger passwords or pass phrases if possible. Longer always is better.
好问题！ 此页面值得一读。特别是，作者声称 MD5 不适合哈希密码：
本文随后解释了一些替代方案，并推荐Bcrypt 作为“正确的选择”（他的话，不是我的）。
免责声明：我根本没有尝试过 Bcrypt。将此视为友好的建议，但我不能用自己的技术经验来支持。
Great question! This page is a good read. In particular, the author claims that MD5 is not appropriate for hashing passwords:
The article then goes on to explain some alternatives, and recommends Bcrypt as the "correct choice" (his words, not mine).
Disclaimer: I have not tried Bcrypt at all. Consider this a friendly recommendation but not something I can back up with my own technical experience.
为了提高密码强度，您应该使用更多种类的符号。如果密码中有 8-10 个字符，那么破解就变得非常困难。尽管使其更长会使其更安全，但前提是您使用数字/字母/其他字符。
SHA1 是另一种散列（单向加密）算法，它速度较慢，但摘要较长。 （编码消息）（160 位），其中 MD5 只有 128 位。
那么SHA2就更加安全了，但是用的比较少。
To increase password strength you should use a wider variety of symbols. If you have 8-10 characters in the password it becomes pretty hard to crack. Although making it longer will make it more secure, only if you use numeric/alphabetic/other characters.
SHA1 is another hashing (one way encryption) algorithm, it is slower, but is has a longer digest. (encoded messsage) (160 bit) where MD5 only has 128 bit.
Then SHA2 is even more secure, but it used less.
对密码加盐始终是额外的防御级别
salting the password is always an extra level of defense
RSA 加密是安全的，因为它依赖于很难分解的非常大的数字。最终，计算机将变得足够快，能够在合理的时间内分解出数字。为了保持领先地位，您需要使用更大的数字。
然而，对于大多数网站来说，散列密码的目的是让有权访问数据库的人读取密码不方便，而不是提供安全性。为此，MD5 就可以1。
这里的含义是，如果恶意用户获得对整个数据库的访问权限，他们就不需要密码。 （前门上的锁不会阻止我从窗户进来。）
1 仅仅因为 MD5 被“损坏”并不意味着您可以随时反转它。
RSA encryption is secure in that it relies on a really big number being hard to factor. Eventually, computers will get fast enough to factor the number in a reasonable amount of time. To stay ahead of the curve, you use a bigger number.
However, for most web sites, the purpose of hashing passwords is to make it inconvenient for someone with access to the database to read the password, not to provide security. For that purpose, MD5 is fine1.
The implication here is that if a malicious user gains access to your entire database, they don't need the password. (The lock on the front door won't stop me from coming in the window.)
1 Just because MD5 is "broken" doesn't mean you can just reverse it whenever you want.
除了是一种加密安全的单向函数之外，用于密码保护的良好散列函数应该难以暴力破解 - 即设计缓慢。 scrypt 是该领域最好的之一。从主页：
也就是说，从常用的哈希函数来看，对 SHA 系列中的任何内容进行数千次迭代对于非关键密码来说是相当合理的保护。
另外，请始终添加盐，以使其无法一次分担暴力破解多个哈希的工作量。
Besides being a cryptographically secure one-way function, a good hash function for password protection should be hard to brute force - i.e. slow by design. scrypt is one of the best in that area. From the homepage:
That said, from commonly available hash functions, doing a few thousand of iterations of anything from the SHA family is pretty reasonable protection for non-critical passwords.
Also, always add a salt to make it impossible to share effort for brute forcing many hashes at a time.
NIST 目前正在举办一场竞赛，以选择新的哈希算法，就像他们选择 AES 加密算法一样。因此，这个问题的答案几年后可能会有所不同。
您可以查找提交的内容并自行研究，看看是否有您想要使用的内容。
NIST is currently running a contest to select a new hashing algorith, just as they did to select the AES encryption algorithm. So the answer to this question will likely be different in a couple of years.
You can look up the submissions and study them for yourself to see if there's one that you'd like to use.