使用 Md5 保存密码
我正在使用 Postgresql、hibernate 和 Java，我需要存储密码。有人可以建议我如何使用 md5 加密密码吗？否则还有更好的方法在数据库中存储安全密码
谢谢
I am using Postgresql,hibernate and Java and I need to store a password. Can someone suggest me how to encrypt the password with md5. Else is there a better way to store secure password in the database
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
您不应该使用 md5 进行密码散列。它专为速度而设计，使其更容易攻击。请改用 bcrypt。此外，您不应该在存储密码后尝试对其进行解密。有关如何根据用户输入验证密码的信息，请参阅 bcrypt 页面上的示例。有关如何安全存储密码的更多信息。
jBcrypt 使用起来也非常简单。以下是对密码进行哈希处理的方法：
并验证它：
You shouldn't use md5 for password hashing. It's built for speed which makes it easier to attack. Use bcrypt instead. Also, you're not supposed to try to decrypt the password after it has been stored. See the examples on the bcrypt page for how to verify a password from user input. More information on how to store passwords safely.
jBcrypt is real simple to use too. Here's how you hash a password:
And to verify it:
MD5 不是 加密算法 - 它是一个加密哈希函数 >。这是非常不同的！您可以将散列密码存储在数据库中，但（通常）无法从密码散列中恢复密码。 这是设计使然。
在某些情况下，可以从散列中取回密码 - 例如，如果密码是字典单词，则可以使用< a href="http://en.wikipedia.org/wiki/Dictionary_attack" rel="nofollow">字典攻击。如果密码足够短并且使用有限范围内的字符，则暴力破解或rainbow table 攻击可以恢复密码。当您存储哈希密码时，您应该使用 salt 和 密钥强化（例如 PBKDF2）使这些攻击变得更加困难。
您还应该注意 MD5 被认为已损坏，建议不要将其用于新应用程序。还有更好的替代方案，例如 SHA-256。
MD5 isn't an encryption algorithm - it is a cryptographic hash function. This is very different! You can store the hashed password in the database, but you cannot (in general) recover the password from the password's hash. This is by design.
In some cases it is possible to get the password back from the hash - for example if the password is a dictionary word it could be recovered using a dictionary attack. If the password is short enough and uses a characters from a limited range a brute force or rainbow table attack could recover the password. When you store a hashed password you should use a salt and key strengthening (for example PBKDF2) to make these attacks more difficult.
You should also be aware that MD5 is considered broken and it is recommended not to use it for new applications. There are better alternatives, for example SHA-256.
1) MD5没有解密。
2) MD5 是一种古老的技术，非常适合检查两个字符串是否相同。
3) MD5 容易受到字典攻击。
4) MD5可以通过使用盐来变得更加安全。
5) 我们使用 MD5 来实现低级别的安全性，因为哈希可以轻松地跨平台复制。 （C++、vb.net、VB6、C#、php ...）
1) There is no decrypt for MD5.
2) MD5 is old technology which is excellent for checking to see if two strings are the same.
3) MD5 is subject to dictionary assaults.
4) MD5 can be made more secure by using a salt.
5) We use MD5 for low level security because the hash can be easily duplicated across platforms. (C++, vb.net, VB6, C#, php ...)
如果您要使用哈希算法，则不会（无法）解密密码。您对密码进行哈希处理并存储哈希值。当用户将来提供密码时，您可以使用相同的算法对其进行哈希处理，并将新的哈希值与之前存储的哈希值进行比较。
您可以使用 Java 中的 MessageDigest 类来散列一个值。参考：用几行 Java 获取 MD5 哈希。
编辑：另外，我同意其他人所说的不要再使用 MD5 的观点。这是一种曾经很常见的旧算法，但它已经被攻击到毫无价值的地步（对于密码而言）。网上有各种用于 MD5 反向查找的资源。
If you're going to use a hashing algorithm, you don't (can't) decrypt the password. You hash the password and store the hash. When the user provides their password in the future, you hash it with the same algorithm and compare the new hash with what you stored before.
You can use the MessageDigest class in Java to hash a value. Ref: Get MD5 hash in a few lines of Java.
Edit: Also, I agree with the others who are saying not to use MD5 for this anymore. It's an old algorithm that used to be common, but it's been attacked to the point of worthlessness (for passwords). There are all sorts of resources online for MD5 reverse lookup.
如果安装 pgcrypto contrib 模块，则可以在 postgres 中执行此操作。
然后你可以像这样加密密码：
当然你根本无法解密它！
正如其他人指出的那样，这可能是一个坏主意，具体取决于您想要做什么。我以前曾被迫使用 MD5，因为另一个应用程序需要它，但您不想向全世界广播该哈希值。
You can do it in postgres if you install the pgcrypto contrib module.
You can then encrypt passwords like this:
Of course you can't decrypt it at all!
As others have pointed out, this may be a bad idea, depending on what you are trying to do. I've been forced to use MD5 before because another application has demanded it, but you don't want to be broadcasting that hash to the world.
我发现 Jasypt 加密库非常有用。
I've found the Jasypt encryption library to be quite useful.