如何散列密码并将其存储以供以后使用另一个摘要进行验证？
我正在使用 gsoap 的 wsseapi 插件，并且希望存储哈希 sha1 密码而不是纯文本。我花了大量时间尝试各种对纯文本密码进行哈希存储的方法。
任何人都可以建议一种对密码进行哈希处理的方法，以便稍后可以根据客户端发送的用户名令牌摘要进行验证吗？
我似乎无法获取客户端密码来根据我存储的哈希进行身份验证。
I am using gsoap's wsseapi plugin and would like to store hashed sha1 passwords rather than plain text. I have spent a ridiculous amount of time experimenting with various methods of hashing the plain text password for storage.
Can anyone suggest a way to hash a password so it can be later verified against a username token digest sent by the client?
I can't seem to get the client password to authenticate against my stored hash.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
不要推出自己的加密货币；使用社区众所周知并接受的方案，例如 PBES2（由 PKCS#5 v2.1）。如果幸运的话，您会找到它的现成实现（提示：OpenSSL 可能做）。
Don't roll your own crypto; use a scheme that's well known and accepted by the community, such as PBES2 (as specified by PKCS#5 v2.1). If you're in luck, you'll find a ready-made implementation of it (hint: OpenSSL probably does).
不存储纯文本密码是好的。选择一个被开发来计算得非常快的哈希值......不是那么聪明。有关“密钥派生”的更多信息，请访问 http://www.tarsnap.com/scrypt.html。基本上，它会减慢“哈希密码的计算”很多，从而减慢攻击者使用暴力的尝试。
not storing plain-text passwords is good. picking a hash which was developed to be calculated very fast is .. not so clever. read more on "key-derivation" at http://www.tarsnap.com/scrypt.html. basically it slows down "calculation of the hashed password" A LOT, so that an attacker is slowed down in his attempts to use brute force.
看来双方都需要明文密码。这样，在服务器上，使用客户端创建的随机数对存储的密码进行散列，然后比较密码散列。
我认为可能有一种方法可以让客户端输入正常的字母数字密码，并让服务器检索预先存储的相同密码的哈希版本以进行比较。由于随机数、时间戳等原因，这似乎是不可能的
Seems that the plain text password is required at both sides. This is so that on the server, the password stored is hashed using the nonce created at the client side and then the password hashes are compared.
I thought there may have been a way for the client to enter a normal alphanumeric password and for the server to retrieve a pre-stored hashed up version of the same password for comparison. Seems this isn't possible because of the nonce, timestamp etc