为什么要将密码哈希截断为 14 个字符？
我正在编写一些代码，有时它正在准备一个密码以存储在数据库中。在粗略的伪代码中，它执行以下操作：
encrypted_password = truncate(hash(password), 14)
即计算密码的哈希值，然后将哈希值截断为 14 个字符。
有谁知道为什么应用程序会以这种方式截断哈希？这是经过深思熟虑的，所以我怀疑它是为了使哈希与我不知道的某种相当标准的密码存储类型兼容。
（请忽略这不是存储密码、不加盐等的好方法......）
I'm working on some code, and at some point it's preparing a password to be stored in a database. In rough pseudocode it's doing the following:
encrypted_password = truncate(hash(password), 14)
I.e. Computing the hash of the password, then truncating the hash to 14 characters.
Does anyone know why the application would truncate the hash in this way? It's very deliberate so I'm suspecting it's to make the hash compatible with some fairly standard type of password store that I'm unaware of.
(Please ignore that this isn't a great way to store passwords, no salting, etc..)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我能想到的唯一原因是保持与某些遗留系统的兼容性。事实上，这是我能想到的在任何情况下做出有意识的决定牺牲安全的唯一原因。
例如，考虑一个具有非常旧的 UNIX 机器的网络，这些机器只能通过经典的 crypt() 函数使用八个字符的密码。为了让他们对其他系统执行身份验证，或者让其他系统对那些旧版 UNIX 系统执行身份验证，每个人都必须使用相同的方法来操作身份验证数据。
事实上，通过网络传输密码（散列、散列 + 加盐或其他方式）的唯一原因是为了遵守遗留系统或具有我所说的“遗留要求”的系统。对于安全意识相对较弱的系统也是如此。
The only reason that I can think of is to maintain compatibility with some legacy system. In fact, that would be the only reason that I can think of to make conscious decisions to sacrifice security in any event.
Consider a network that has insanely old UNIX boxes, for example, that are only capable of using eight character passwords with the classic crypt() function. In order for them to perform authentication against other systems, or for other systems to perform authentication against those legacy UNIX systems, everyone has to manipulate the authentication data using the same method.
In fact, the only reason to transmit passwords (hashed, hashed + salted, or otherwise) over the network is in order to adhere to a legacy system or a system that otherwise has what I would call "legacy requirements". The same goes for systems that are otherwise relatively weak in the security sense.