防止对有限值集的原像攻击
我询问过对社会安全号码的哈希值进行原像攻击的成本。 我得到的很好的答案是，社会安全号码的类型只有 366,000,000 个哈希值，这将使原像攻击变得容易。
我现在的问题是是否有可能完全避免原像攻击。我的场景是，多个客户端需要将社会安全号码存储在中央服务器上。客户端之间的散列必须一致。客户可以与在线网络服务进行通信。
I have asked about the cost of running a preimage attack on the hashes of social security numbers. The excellent answer I got was that the type of social security numbers only has 366,000,000 hashes, which would make it easy to run a preimage attack.
My question now is whether it is possible to avoid a preimage attack altogether. My scenario is that several clients need to store the social security number on a central server. The hashing must be consistent between the clients. The clients could communicate with online web services.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您的问题与使用密码时必须执行的操作类似。密码适合人脑，因此猜起来不会太困难。
使用低熵秘密时，有两种互补的方法可以减轻风险：
使散列更昂贵的一种方法是对n个数据副本的串联进行散列，n尽可能大（取决于客户端的计算能力，最终，用户的耐心）。例如，对于（虚拟）SSN“123456789”，请使用 H(123456789123456789123456789...123456789)。您可以在这里以百万为单位计算n；在基本 PC 上，SHA-256 每秒可以轻松处理一百兆字节。
salt 是一段公共数据，与数据一起用于哈希（SSN），并且对于每个用户来说都是不同的。盐不需要保密，但不应该重复使用（或至少不经常重复使用）。由于 SSN 往往是永久性的（一个人一生都有一个唯一的 SSN），因此您可以使用用户名作为盐（这与密码形成对比，用户可以更改密码，并且应该为每个用户使用新的盐）新密码）。因此，如果用户 Bob Smith 的 SSN 123456789，您最终将使用：H("Bob Smith 123456789 Bob Smith 123456789 Bob Smith 123456789... Smith 123456789")，并进行足够的重复以使该过程充分进行慢的。
假设您可以在一台不太新的计算机上让用户等待一秒钟（很难让用户等待更多），可以预见的是，即使是坚定的攻击者在尝试超过几百个 SSN 时也会遇到困难每秒。破解单个 SSN 的成本将以周为单位计算，并且由于使用用户名作为盐，攻击者将没有捷径（例如，加盐会击败预先计算的表，包括大肆宣传的“彩虹表”） 。
Your problem is similar to what must be done when using passwords. Passwords fit in human brains, and, as such, cannot be much difficult to guess.
There are two complementary ways to mitigate risks when using low-entropy secrets:
One way to make hashing more expensive is to hash the concatenation of n copies of the data, with a n as big as possible (depending on the computing power of the clients, and, ultimately, the patience of the user). For instance, for (dummy) SSN "123456789", use H(123456789123456789123456789...123456789). You would count n in millions here; on a basic PC, SHA-256 can easily process a hundred megabytes per second.
A salt is a piece of public data which is used along the data to hash (the SSN), and which is different for each user. A salt needs not be secret, but it should not be reused (or at least not often). Since SSN tend to be permanent (an individual has a unique SSN for his whole life), then you can use the user name as salt (this contrasts with passwords, where a user can change his password, and should use a new salt for every new password). Hence, if user Bob Smith has SSN 123456789, you would end up using: H("Bob Smith 123456789 Bob Smith 123456789 Bob Smith 123456789... Smith 123456789") with enough repetitions to make the process sufficiently slow.
Assuming you can make the user wait for one second (it is difficult to make a user wait for more) on a not-so-new computer, it can be expected that even a determined attacker will have trouble trying more than a few hundred SSN per second. The cost of cracking a single SSN will be counted in weeks, and, thanks to the use of the user name as a salt, the attacker will have no shortcut (e.g. salting defeats precomputed tables, including the much-hyped "rainbow tables").