ASP.NET：SHA1 +多台服务器上的 Salt 密码哈希
因此，我采用 David Hayden 在他的博客 (http://davidhayden.com/blog/dave/archive/2004/02/16/157.aspx) 上发布的方法来创建盐并通过获取用户的密码来哈希用户的密码原始密码和生成的盐并使用 SHA1 哈希该值。
然后，我将盐和散列密码存储在数据库中。
该网站目前是负载平衡的，所以我想知道两台服务器的结果哈希值是否相同。
以下是 David Hayden 博客上发布的代码片段：
private static string CreateSalt(int size)
{
//Generate a cryptographic random number.
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
byte[] buff = new byte[size];
rng.GetBytes(buff);
// Return a Base64 string representation of the random number.
return Convert.ToBase64String(buff);
}
private static string CreatePasswordHash(string pwd, string salt)
{
string saltAndPwd = String.Concat(pwd, salt);
string hashedPwd =
FormsAuthentication.HashPasswordForStoringInConfigFile(
saltAndPwd, "sha1");
return hashedPwd;
}
我问的原因是这段代码使用了代码片段：
FormsAuthentication.HashPasswordForStoringInConfigFile(
saltAndPwd, "sha1");
So, I am the approach David Hayden posted on his blog (http://davidhayden.com/blog/dave/archive/2004/02/16/157.aspx) to create a salt and hash the user's password by taking the user's raw password and the generated salt and using SHA1 to hash the value.
I then store the salt and the hashed password in the database.
The website is currently load balanced, so I was wondering if resulting hash value would be the same for both servers.
Here is the snippet of code posted on David Hayden's blog:
private static string CreateSalt(int size)
{
//Generate a cryptographic random number.
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
byte[] buff = new byte[size];
rng.GetBytes(buff);
// Return a Base64 string representation of the random number.
return Convert.ToBase64String(buff);
}
private static string CreatePasswordHash(string pwd, string salt)
{
string saltAndPwd = String.Concat(pwd, salt);
string hashedPwd =
FormsAuthentication.HashPasswordForStoringInConfigFile(
saltAndPwd, "sha1");
return hashedPwd;
}
The reason I ask is that this code uses the code snippet:
FormsAuthentication.HashPasswordForStoringInConfigFile(
saltAndPwd, "sha1");
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为您在这里问的关键问题是 SHA1 算法是否与运行在其上的服务器相同。在这种情况下，答案是肯定的。
假设您将生成的盐以及密码哈希存储在所有服务器都可以访问的地方？因此，用于生成盐的方法不需要在服务器之间保持一致。
I think the key question your asking here is if the SHA1 algorithm is the same whatever server it is running on. In which case the answer is yes.
Presumably you store your generated salt somewhere that all the servers can access it, along with the password hash? So the method used to generate the salt doesn't need to be consistent across servers.
此方法将仅使用传递给它的参数。
不用担心；它会起作用的。
This method will only use the parameters passed into it.
Don't worry about it; it will work.
“要解决此问题，Web 场中所有计算机上的validationKey 和decryptionKey 值必须相同。”
http://msdn.microsoft.com/en-us/library/ff647070 .aspx#pageexplained0002_webfarmscenarios
"To address this issue, the validationKey and decryptionKey values must be identical on all computers in the Web farm."
http://msdn.microsoft.com/en-us/library/ff647070.aspx#pagexplained0002_webfarmscenarios