在没有数据库的情况下使用 PHP 加密密码最安全的方法是什么
我正在开发一个应用程序，我不希望任何人弄清楚管理员用户名/密码的算法。
首先我想澄清一下：
- 网站安全只是基于算法的复杂程度吗？
- 最安全的方法是什么，或者您可以推荐 GPL 源代码链接吗？ （这是否不可行，因为任何可以识别我从哪里获取源代码的人都可以访问这些算法？）
- 我不在我的应用程序中使用MySQL，我不需要。
您对我如何在不花钱的情况下获得尽可能安全的建议是什么？时间对我来说是一种奢侈。。只需 PHP 和最少的 JavaScript。
I'm working on an application and I don't want anyone figuring out the algorithm for the admin username/password.
I would like to clarify first of all:
- Is website security just based on the complexity of algorithms?
- What's the most secure method, or maybe there's a GPL source code link you can recommend? (Would that not be feasible since the algorithms are accessible to anyone who can Identify where I got the source code from?)
- I'm not using MySQL for my application, I don't need to.
What's your suggestion for how I get as secure as possible without spending money. Time is a luxury I do have. Just PHP and minimal JavaScript.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
您需要的是散列算法（例如 md5 或 sha1），这些算法是“单向”的，这意味着您可以轻松地对字符串（例如密码）进行散列，并将生成的散列与存储的散列进行比较。但是，您无法获取哈希值并将其转换回密码。
请参阅http://gr.php.net/manual/en/function.sha1。 php 用于 sha1 函数。
MD5 和 SHA1 是众所周知的算法，SHA1 更安全，因为当前有机制可以更轻松地暴力破解 MD5 哈希值。
What you need is a hashing algorithm (such as md5 or sha1), these are "one-way", meaning you can easily hash a string such as a password, and compare the resulting hash to your stored hash. You cannot however take the hash and convert it back to the password.
See http://gr.php.net/manual/en/function.sha1.php for the sha1 function.
MD5 and SHA1 are well known algorithms, SHA1 is the more secure as there are current mechanisms to facilitate easier bruteforcing of MD5 hashes.
密码绝对不能加密，这明显违反了CWE- 257.。密码必须始终经过哈希处理，并且SHA256 是一个非常好的选择。
SHA256 非常强大且非常安全，因为它是公开的并且经过严格审核。出于安全考虑，应避免使用私有算法，因为它被称为“（in）虽然模糊但安全 ”
Passwords MUST NEVER be encrypted, this is a clear violation of CWE-257. Passwords must always be hashed and SHA256 is a very good choice.
SHA256 is extremely powerful and very secure because it is public and there for heavily audited. The use of a private algorithm is shunned in secuirty as it is called "(in)security though obscurity"
我建议您首先阅读这篇文章： http://phpsec.org/articles/2005 /password-hashing.html
它告诉您如何使用盐生成安全哈希。如果您阅读整篇文章，您应该能够理解如何改进最后的最终功能。
I would recommend you start by reading this article: http://phpsec.org/articles/2005/password-hashing.html
It tells you how to generate a secure hash using a salt. If you read the whole article you should be able to understand how to improve the final function at the end.
我建议使用专门设计用作密码哈希的哈希函数，例如 bcrypt，与 SHA256 等标准哈希相反。这使得在哈希值泄露的情况下破解密码变得更加困难。
I suggest using a hash function that has been specifically designed for use as password hash, such as bcrypt, as opposed to standard hashes like SHA256. This makes it much harder to crack the passwords in case the hashes leak.
您的问题似乎暗示加密的密码可以通过某种方式从网络访问。
这种情况不应该发生 - 要么使用
.htaccess或等效的方法来限制对该文件的访问，或者只是将其存储在文档根目录之外。这样，即使潜在的攻击者确实知道加密算法，他们也不会尝试解密任何内容。也就是说，有大量的加密哈希算法，它们会将您的密码加密为某种形式即使攻击者确实获取了您的密码文件/文本，这种情况也极不可能（但并非不可能）被逆转。
上面的维基百科文章有一个不错的列表，其中包含各种算法以及当前对难度的估计反转每种情况的加密密码。
大多数现代环境已经支持这些最有效的算法。对于 PHP：
http://php.net/manual/en/function.sha1.php< /a>
http://php.net/manual/en/function.hash.php< /a>
第二个提供了多种选择...
编辑：
请记住，如果您选择的密码是
johnycash或类似的易于破解的密码，那么即使是最好的哈希算法也没有多大帮助。猜测使用暴力字典攻击。很多时候，系统最薄弱的环节在于使用它的人......
Your question seems to imply that the encrypted password is somehow accessible from the network.
That should not happen - either use
.htaccessor equivalent to restrict access to that file, or simply store it outside your document root. That way a potential attacker won't have anything to attempt to decrypt even if they do know the encryption algorithm.That said, there is a large number of crytpographic hashing algorithms, that will encrypt your password to a form that is highly improbable (but not impossible) to be reversed, even if an attacker does acquire your password file/text.
The Wikipedia article above has a nice list with various algorithms and the current estimates about the difficulty of reversing an encrypted password for each case.
Most modern environments already have support for the most potent of these algorithms. For PHP:
http://php.net/manual/en/function.sha1.php
http://php.net/manual/en/function.hash.php
The second one provides some variety to choose from...
EDIT:
Keep in mind that even the best hashing algorithm won't help very much if your chosen password is
johnycashor something similarly easy to guess using a brute force dictionary attack.Quite often, the weakest link of a system lies in the people that use it...
回复：“网站安全只是基于算法的复杂性吗？”
不，您需要做很多事情才能确保网站安全。
您必须防止的一些事情是：
以及可能还有更多...
Re: "Is website security just based on the complexity of algorithms?"
No, there are many thing you need to do to make a website secure.
Some things you must prevent are:
and probably many more...