对多个字段使用相同的盐
我有一排连续的字段正在散列和加盐。每行的盐都不同。我决定对每行中的几个字段进行哈希/加盐。
与为每个字段生成新的盐相比，对同一行中的这些新字段使用相同的盐是否会使数据更容易受到彩虹攻击？我的逻辑是，同一行中只有几个字段会使用相同的盐，这将使键/盐管理变得更加容易。
I have a field in a row that I'm hashing and salting. The salt for each row is different. I decided to hash/salt a couple of more fields in each row.
Would using the same salt for those new fields in the same row make the data more susceptible to rainbow attacks compared to if I were to generate a new salt for each field? My logic is that it's only a couple of more fields in the same row that will use the same salt and it would make key/salt management much easier.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不，如果有人有一张足够大的彩虹桌可以打破你的盐，那么你使用太小的盐就会搞砸。添加到盐中的每个字节都会使彩虹表呈指数级增长。在哈希中添加盐不会使预先计算的攻击变得不可能，只会变得更加困难。
重复使用盐会使您的系统更容易受到攻击。攻击者可以创建一个帐户，然后使用 SQL 注入从数据库中提取他的加盐哈希。然后他可以使用 John The Ripper 暴力破解盐（因为他知道自己的密码）。如果盐存储在数据库中，那么他可以使用 SQL 注入提取盐和哈希值，并与 John 一起破解未知密码的哈希值。如果密码是字典单词，则只需不到一个小时即可破解。
No, if someone has a rainbow table large enough to break you salt then you messed up by using a salt that is too small. Each byte you add to your salt makes the rainbow table exponentially larger. Adding a salt to your hash does not make a pre-computed attack impossible, only more difficult.
Re-use of a salt makes your system more prone to attack. An attacker can create an account, and then pull his salted hash out of the database using SQL Injection. Then he can brute force the salt (because he knows his own password) using John The Ripper. If the salt is stored in the database, then he can pull the salt and the hash using SQL injection and break the hash of an unknown password with John. If the password is a dictionary word it will take less than an hour to break.
是的，但是数据对于使用多种盐真的那么重要吗？如果每行使用一种盐，这应该足够了。有关更多与盐相关的信息，请参阅本文：http://php-security.org/2010/05/26/mops-submission-10-how-to-manage-a-php-applications-users-and -密码/
Yes, but is the data really this important to use multiple salts? If you use one salt per row, this should be sufficient. For more salt-related info see this article: http://php-security.org/2010/05/26/mops-submission-10-how-to-manage-a-php-applications-users-and-passwords/