加盐密码 - 有比使用时间戳更好的选择吗？
我目前正在构建几个 ASP.NET MVC 2 站点，并且想知道我可以选择哪些选项来对密码进行加盐。在我的 PHP 工作中，我通常只获取用户注册时的时间戳，然后将其附加到密码字符串的末尾，然后使用 SHA1 对整个内容进行哈希处理。我的直觉是这种方法可能还不够。
无论如何，我对 ASP.NET 的用户管理还很陌生，因此我认为从一开始就采用最佳实践最符合我的利益。我知道 ASP.NET Web 表单具有可用的内置用户管理，但不确定 MVC。
I'm currently building a couple of ASP.NET MVC 2 sites, and am wondering what my options are for salting a password. With my PHP work, I usually just obtained the timestamp of when a user registered, then appended it to the end of their password string before using SHA1 to hash the entire thing. My instinct is that this approach may not be sufficient.
I'm pretty new to user administration with ASP.NET anyway, so I figure it would be in my best interest to get started with best practices from the beginning. I know that ASP.NET web forms have built-in user administration available, but am unsure about MVC.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
SALT 的唯一目的是防止彩虹攻击，即多个用户的密码具有相同的哈希值，因此成功反转一个密码意味着您也知道它是具有相同哈希值的其他所有人的密码。即使是个位数的盐也可以防止这种情况，因为具有相同密码的两个用户如果具有不同的盐，将具有不同的哈希值。
只要盐是不会改变的，并且对于每个用户来说都是不同的，任何值都可以很好地工作。他们的注册时间戳，只要您不更新该字段（这将使他们的密码哈希无效并阻止他们登录）是一个不错的选择。
The only point of a SALT is to prevent rainbow attacks, where multiple users have the same hash for their password, so reversing one password successfully means you also know it's the password for everybody else with the same hash. Even a single-digit salt will prevent that, since two users with the same password will have different hashes if they have different salts.
As long as the salt is something that won't change, and that is different for every user, any value will work well. Timestamp of their registration, provided you don't update that field (which would invalidate their password hash and prevent their login) is a fine choice.