加密哈希密码？
使用强加密（AES 192 左右）对存储在数据库中的散列和加盐密码进行加密是常识吗？还是我们只是瞄准星星？
当然，加密密钥不会位于数据库本身中，而是保存在安全的地方。
多谢！
Is it common sense to encrypt hashed&salted passwords that are stored in a database with a strong encryption (AES 192 or so) or are we just aiming for the stars?
Of course, the encryption key will not be in the database itself, but will be kept at a safe place.
Thanks a lot!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
无需加密加盐和散列密码。
当使用良好的加密算法对密码进行加盐和散列处理时，它不会提高安全性。
当你加密它时，你必须以某种方式管理密钥，这只会让事情变得复杂。
为每个密码使用加密生成的盐，并使用良好的哈希算法。
有关更多信息，请参阅此问题：在数据库中存储密码的最佳方法
There is no need to encrypt a salted and hashed password.
When the password is salted and hashed with a good algorithm encrypting it will not improve the security.
When you encrypt it you have to manage the key in some way, that will just complicate things.
Use a cryptographic generated salt one for each password, and use a good hashing algorithm.
For more information see this question: Best way to store password in database
我不是安全专家，我不知道您正在运行什么类型的应用程序或您有什么类型的设置。但如果我正在制作一个常规的网络应用程序，我只会使用加盐哈希。
无论如何，您都将在应用程序服务器上存储密钥（如果您使用非对称密钥加密，则为公钥，因为您可以加密用户提供的密码的哈希值并将其与数据库中的值进行比较）。
如果您主要担心有人闯入您的数据库服务器，那么闯入应用程序服务器是否会更困难？
如果有人尝试通过应用程序服务器进行字典攻击，则无论哪种方式都将花费相同的尝试次数。您只需要检测并阻止它即可。
加密加盐哈希有用的唯一情况是攻击者可以获得加密值但无法获得密钥。我想这取决于您来决定这是否是您想要的系统。
I'm not a security expert and I don't know what kind of application you are running or what kind of setup you have. But if I were making a regular ol' web app, I would just go with salted hash.
You're going to store the key (or public key if you're using asymmetric key encryption as you could encrypt the hash of password user provides and compare that to the value from the database) on the application server anyway.
If you're mainly worried about someone breaking into your database server, is it any harder to break into the application server?
If someone tries a dictionary attack through the app server, it's going to take the same number of tries either way. You'll just need to detect and block that.
The only situation in which encrypting the salted hashes is useful is if attackers can get their hands on the encrypted values but not the key. I guess it's up to you to decide if that's what you want for your system.
除非您确实需要检索密码，否则密码应始终进行哈希处理而不是加密。密码检索本身通常不被认为是好的做法。
Passwords should always be hashed and not encrypted unless you really need password retrieval. Password retrieval is itself not usually considered good practice.