检索密钥的安全方法
我正在开发一个带有红色按钮的应用程序。这意味着每个客户帐户都有两个自动生成的（秘密）密钥。当有人在特殊（公共）页面上输入这些密钥时，就会启动特定的过程。该过程并不重要，但这
一切都已解决，密钥在创建用户帐户时自动生成，加密存储在数据库中，并向用户显示一次，以便他可以按照自己认为合适的方式分发密钥。如果他愿意的话，他当然可以重置钥匙。
问题是，有些客户总是忘记带钥匙。我们的解决方案是重置密钥并重新分发新密钥，但对于某些客户来说这是不切实际的。我想提供检索密钥而不重置密钥的选项。
我的想法是能够使用用户的密码解密密钥，这意味着已经登录的用户必须再次输入他的密码，该密码用于加密密钥，现在用于解密它们。我只是不确定这在技术上是如何工作的（是否有我可以使用的加密/解密算法？）以及在采用这种技术之前是否应该考虑什么。
有人对此有什么想法吗？也许还有更好的建议？
I'm working on an app that has a red button. What that means is that every client account has two (secret) keys that are automatically generated. When someone enters those keys on a special (public) page, a certain process will be set in motion. The process is not critical, but
That's all taken care of, the keys are automatically generated on user account creation, stored encryped in the database and are shown to the user once so he can distribute the keys as he sees fit. He can of course reset the keys if he wants to.
The thing is, some clients keep forgetting the keys. Our solution is to reset the keys and redistribute the new keys, but for some clients that's just not practical. I'd like to offer the option of retrieving the keys without resetting them.
My idea was to be able to decrypt the keys using the user's password, meaning that the already logged in user would have to enter his password again, which was used to encrypt the keys and is now used to decrypt them. I'm just not sure how that would technically work (is there an encryption/decryption algorithm that I could use?) and whether there's anything I should consider before employing such a technique.
Does anyone have any ideas on this? Maybe even a better suggestion?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您想查看 AES 等密码。
我会查看 这个 gisthub 示例，了解如何使用 Ruby 和 AES 进行加密和解密。
You want to check out ciphers like AES.
I'd check out this gisthub example on how to use Ruby and AES for encryption and decryption.