更改 devise 和 Rails 3 以使用 bcrypt 而不是 sha
我有一个 Rails 3 生产应用程序，它使用 devise 来处理身份验证。我想在应用程序上更改为使用 bcrypt 而不是 sha，但我找不到任何资源来解释从一种迁移到另一种的过程。我假设您需要采取某种后备措施来处理目前的密码以某种方式与 sha 一起加盐的事实...
以前有人这样做过吗？！有任何提示、教程、演练等吗？！
I've got a rails 3 production app that uses devise to deal with authentication. I'd like to change to using bcrypt instead of sha on the app but I can't find any resources that explain the process of migrating from one to the other. I am assuming that you will need to have some sort of fallback in place to handle the fact that the passwords at the moment are salted a certain way with sha...
Anyone done this before?! Any tips, tutorials, walk-throughs, etc?!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为没有您想要的解决方案。我只知道两个选项 -
重置所有用户密码并通过电子邮件告诉他们这已经完成（最好是为什么，这样他们就不会惊慌失措）
，当每个用户登录时，检查您拥有的旧哈希系统，如果它有效，在新列中创建新的 bcrypt 哈希，然后删除旧的、安全性较低的哈希，并以这种方式开始缓慢的迁移。
创建一个彩虹表来移动每个人所需的数学能力是不可能的。
I don't think there is a solution you would like. I only know of two options -
reset all user passwords and email them telling them this has been done (and preferably why so they don't freak out)
as every user logs in, check against the old hash system you had, if it validates, create a new bcrypt hash in a new column and then remove the old, less secure hash and begin a slow migration that way.
The mathemtical power needed to create a rainbow table to move over everyone just isn't likely.
这里有一个更好的算法，可以让你同时切换每个人。您必须弄清楚如何在设计中实现这一点，但这是概要。这不是我的，是在网上通过所注明的 URL 找到的。
http://blog.jgc.org /2012/06/one-way-to-fix-your-rubbish-password.html
假设您有一个数据库，其中包含您网站的 n 个用户以及您拥有的每个用户的密码哈希值salt si 和 hash hi （其中 hi 是使用某种算法（例如 SHA1 或 MD5）计算的）。 （请注意，如果没有 salt，这些说明的其余部分将起作用，只需忽略它）。
假设您选择使用 scrypt。对于每个用户，您首先创建一个新的随机盐值 s'i，然后使用公式 scrypt(s'i, hi) 计算新的哈希值 h'i，并将新的盐值和哈希值存储在数据库中。你扔掉旧的弱哈希 hi 并忘记它曾经存在过。所以你只剩下两个盐值和一个新的哈希值。 （我忽略了其他 scrypt 参数，这些参数留给读者自行确定）。
当用户 i 登录并提供密码 p 时，您使用旧的弱哈希算法（假设它是 md5（盐，密码））来计算哈希以进行比较，如下所示： scrypt(s'i, md5(si, p)) 并将其与数据库中存储的 h'i 进行比较。
如果像last.fm一样，您还允许第三方通过提供旧的哈希值而不是密码来授权用户，那么您仍然可以使用此方案。当第三方提供用户 i 的哈希 h 时，您计算 scrypt(s'i, h) 并进行比较。
如果不需要第 4 步，那么您可以在用户登录时进一步操作。用户使用密码 p 成功登录后，您可以通过选择新的随机盐值 s' 来完全消除旧弱哈希的任何痕迹。 'i 并计算 scrypt(s''i, p) 并将其存储在数据库中。
如果您的密码数据库被盗，这会立即使您的密码数据库变得更加安全，而无需用户付出任何努力。
Here's a better algorithm for ya, that will let you switch everyone over at once. You'll have to figure out how to implement this in devise, but here's the outline. This isn't mine, found on the web at the URL noted.
http://blog.jgc.org/2012/06/one-way-to-fix-your-rubbish-password.html
Suppose you have a database that contains password hashes for the n users of your site, and for each user you have salt si and hash hi (where hi was computed with some algorithm such as SHA1 or MD5). (Note that the rest of these instructions work if there's no salt, just ignore it).
Suppose that you've chosen to use scrypt. For each user you first create a new random salt value s'i and then compute a new hash h'i using the formula scrypt(s'i, hi) and store the new salt and hash in the database. You throw away the old weak hash hi and forget it ever existed. So you are left with two salt values and a new hash. (I've ignored the other scrypt parameters which are left to the reader to determine).
When user i logs in and presents password p you use your old weak hash algorithm (let's suppose it was md5(salt, password)) to compute a hash for comparison as follows: scrypt(s'i, md5(si, p)) and compare that with the h'i stored in the database.
If, like last.fm, you were also allowing third-parties to authorize users by presenting the old hash value instead of the password then you can still use this scheme. When the third-party presents hash h for user i you calculate scrypt(s'i, h) and do the comparison.
If step 4 is not needed then you can go further when a user logs in. Once the user has logged in successfully with password p you can completely eliminate any trace of the old weak hash by choosing a new random salt value s''i and computing scrypt(s''i, p) and storing that in the database.
This has the effect of immediately making your password database more secure if stolen without any effort on the part of your users.
用户模型：
devise-users 迁移文件：
这些设置可供您使用吗？
the User model:
the devise-users migration file:
Are these settings available for you?