如何在 C# Windows 窗体应用程序中轻松添加密码？

发布于 2024-09-05 17:40:58 字数 61 浏览 5 评论 0原文

如何轻松地从 Textbox.Text 中添加密码？

.NET 框架中有一些内置的魔法吗？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

太阳哥哥 2024-09-12 17:40:58

不久前，我们就对密码加盐时的最佳实践进行了一次精彩的讨论，您可能会在那里找到一些很棒的想法：

对您的密码加盐：最佳实践？

我发现最简单且相当安全的方法之一是使用 GUID 作为您的加盐。它是随机的并且足够长。如果包含 GUID 的字符串格式（“{”和“-”字符），效果最佳，但并非必须如此。

请记住，每个加盐项目的盐必须是唯一的，为了最安全，您应该使用加密安全的随机数生成器。还请记住，您必须将盐与密码一起存储，否则您将无法根据哈希版本检查明文版本！如果您愿意，您可以不加密地存储盐；我通常将其与密码放在同一个表的字段中。盐的目的不是保持隐藏，而是使彩虹表难以（希望不可能）及时计算。

下面是一个适用于 C# 的快速片段：

RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
byte[] buffer = new byte[1024];

rng.GetBytes(buffer);
string salt = BitConverter.ToString(buffer);
var saltedPassword = password + salt;

或者...

var salt = Guid.NewGuid().ToString();
var saltedPassword = password + salt;

We had a great discussion a while ago about best practices when salting a password, you might find some great ideas there:

Salting Your Password: Best Practices?

I've found that one of the easiest, while still being fairly secure, is to use a GUID as your salt. It's random and sufficiently long. It works best if you include the string formatting of the GUID (the '{' and '-' characters), but you don't have to.

Remember that the salt has to be unique per item salted and that to be most secure, you should use a cryptographically secure random number generator. Remember also that you have to store your salt along with the password, or you won't be able to check the plaintext version against the hashed version! You can store the salt un-encrypted if you like; I typically put it in a field on the same table as the password. The purpose of the salt isn't to remain hidden, it's to make rainbow tables difficult (hopefully impossible) to compute in a timely manner.

Here's a quick snippet that will work in C#:

RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
byte[] buffer = new byte[1024];

rng.GetBytes(buffer);
string salt = BitConverter.ToString(buffer);
var saltedPassword = password + salt;

or...

var salt = Guid.NewGuid().ToString();
var saltedPassword = password + salt;

回复收藏 0 原文

尘曦 2024-09-12 17:40:58

我想您是在要求用户名和密码吗？

在某些系统中，用户名用作盐。（我认为这样做是可以的。）
否则，您需要将盐存储在某处并在散列之前检索它（在随机创建盐的情况下），或者有一个算法将为同一用户返回相同的盐（并且仅仅使用普通的盐并不更好）用户名）。

个人使用如下代码：

byte[] GetSaltedPasswordHash(string username, string password)
{
    byte[] pwdBytes = Encoding.UTF8.GetBytes(password);
    // byte[] salt = BitConverter.GetBytes(userId);
    byte[] salt = Encoding.UTF8.GetBytes(username);
    byte[] saltedPassword = new byte[pwdBytes.Length + salt.Length];

    Buffer.BlockCopy(pwdBytes, 0, saltedPassword, 0, pwdBytes.Length);
    Buffer.BlockCopy(salt, 0, saltedPassword, pwdBytes.Length, salt.Length);

    SHA1 sha = SHA1.Create();

    return sha.ComputeHash(saltedPassword);
}

I suppose you are asking for a username along with the password?

In some systems username is used as a salt. (And I think it is OK to do that.)
Otherwise you'll need to have your salt stored somewhere and retrieve it before hashing (in case of random-created salt) or have an algorithm which will return the same salt for the same user (and it is not better that just using a plain username).

Personally use the following code:

byte[] GetSaltedPasswordHash(string username, string password)
{
    byte[] pwdBytes = Encoding.UTF8.GetBytes(password);
    // byte[] salt = BitConverter.GetBytes(userId);
    byte[] salt = Encoding.UTF8.GetBytes(username);
    byte[] saltedPassword = new byte[pwdBytes.Length + salt.Length];

    Buffer.BlockCopy(pwdBytes, 0, saltedPassword, 0, pwdBytes.Length);
    Buffer.BlockCopy(salt, 0, saltedPassword, pwdBytes.Length, salt.Length);

    SHA1 sha = SHA1.Create();

    return sha.ComputeHash(saltedPassword);
}

回复收藏 0 原文