加密密码的最佳方法是什么？
我即将为我的应用程序进行“登录”，并且想知道为我将在数据库中输入的用户密码进行加密的最佳方法是什么？我在Google上找到了很多方法，但不知道哪个是最好的。
I am about to make a 'Log In' for my app and was wondering what is the best way to encrypt a password for my user that i will enter in my database ? I found many way on Google but don't know which is the best.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
我会选择一种单向加盐哈希。
例如，使用 SHA1 哈希，您可以将密码存储为哈希，而该哈希无法反转回原始密码。然后，当用户输入他/她的密码时，您对密码执行相同的 SHA1 散列，并将该散列与您存储在数据库中的散列进行比较，如果它们匹配，则密码是正确的。
为了进一步保护散列，您可以添加盐，这本质上是您为每个用户生成的随机生成的值，然后创建帐户，并将盐值存储在用户记录中。创建密码的哈希值时，首先将密码与盐组合，并对组合值进行哈希处理。要验证用户身份，请将输入的密码与为用户存储的盐相结合，对组合值执行哈希并进行比较。
通过将盐添加到混合物中，您可以确保碰巧相同的密码的哈希值具有不同的哈希值，因为加盐部分不同。因此，如果两个用户具有相同的密码“Password1234”，则两个用户存储的哈希值将不相同，因此无法确定两个用户具有相同的密码。
I would go with a one way salted hash.
Using a SHA1 hash for example, you would have a way to store the password as a hash which cannot be reversed back to the original password. Then when the user enters his/her password you perform the same SHA1 hash on the password and compare that hash with what you have stored in the DB, if they match then the password is correct.
To further secure the hashing, you can add a salt, this is essentially a randomly generated value that you generate for each user then you create the account, and store the salt value in the user record. When you create the hash of the password, you first combine the password with the salt and hash this combined value. To authenticate the user you combine the entered password with the salt stored for the user, perform the hash on the combined value and compare.
By adding the salt to the mix, you ensure that the hash for passwords that happend to be the same have a different hash because the salted portion differs. So if two users have the same password "Password1234", the stored hash for the two will not be the same so it cannot be determined that two users have the same password.
我建议使用 Rfc2898DeriveBytes
它使用了良好的标准化密钥派生函数和现代哈希。除了密码之外，您还需要传递盐以防止彩虹表。它会为您混合盐和密码，因此您无需自己弄清楚如何做到这一点。
I recommend using Rfc2898DeriveBytes
It uses a good standardized Key-Derivation-Function, and modern hashes. You need to pass in a salt in addition to the password to prevent rainbow-tables. And it mixes salt and password for you, so you don't need to figure out how to do that yourself.
使用 bcrypt。不，真的，放弃构建自己的方法的任何想法，使用 bcrypt 。世界上已经有足够多的自制不安全密码哈希方案。
存储加盐的密码哈希值，当然还有每个用户的盐，这一切都很好。但加盐只能防止彩虹表攻击，并不能防止暴力破解。因此，矛盾的是，您不想使用快速方法来生成或验证密码哈希值。 MD5、SHA，无论什么——它们都很快。跟我重复一遍：使用 bcrypt。
Use bcrypt. No, really, drop whatever ideas you have of building your own method, and use bcrypt. The world has enough homebrew insecure password hashing schemes already.
Storing salted password hashes, with per-user salts of course, is all well and good. But salting only prevents rainbow table attacks, it doesn't prevent bruteforcing. So, paradoxically, you don't want to use a fast method to generate or verify the password hashes. MD5, SHA, whatever - they're all fast. Repeat after me: use bcrypt.
您可以使用 RSA 算法： http://www.codeproject.com/KB/security/RSACryptoPad .aspx
You can use RSA Algorithm: http://www.codeproject.com/KB/security/RSACryptoPad.aspx
通常使用.net框架提供的加密算法
，许多应用程序使用MD5算法
请参阅此处
Use Cryptography algorithm provided by .net framework
normally , many application uses MD5 algorithem
See here