可以将用户的盐与密码哈希保存在同一个表中吗？
是不是还好而且没啥用？它可以保存在另一个表甚至另一个数据库中。
你怎么认为？
PS 为了更高的安全性，我也有常量的盐“花生”。它是保存在配置文件（而不是数据库）中的常量值。因此，如果黑客想要以某种方式破解密码，他还需要访问文件服务器和数据库。
Is it okay and isn't useless? It could be saved in another table or even another database.
What do you think?
P.S. For higher security, I have the constant salt "peanuts" too. It's constant value saved in configuration file (not in database). So if hacker want to somehow hack password, he need access to file server and database as well.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，可以将每个用户的盐存储在存储密码哈希的同一个表中（不是密码本身） - 即使对手可以访问原始数据数据库数据，他仍然需要分别尝试每个用户的盐+密码；将盐存储在另一个表中并没有真正增加任何重要的安全性（如果您假设对手可以访问数据库，那么假设他只能访问数据库的一部分对我来说没有多大意义）。
如果您使用 salt+peanuts+password 来创建密码哈希，那么我想说您的设计比 80% 的系统更安全 - 也就是说，相当安全，但不会过度偏执。
但请注意，如果您实际上以可恢复的形式（加密或明文）存储密码，则您将放弃任何安全性 - 盐和散列的全部要点是您不存储密码以可恢复的形式。如果您确实存储了密码，那么这就是系统最薄弱的环节，从而完全不安全。为了明确起见：用户表应该只包含盐+花生+密码的盐和哈希，绝不是密码本身。
Yes, it's okay to store the per-user salt in the same table which stores the password hash (not the password itself) - even if the adversary gets access to the raw database data, he'd still need to try each user's salt+password separately; storing the salt in another table is not really adding any significant security (if you assume the adversary has access to the database, it doesn't make much sense to me to assume he only has access to one part of it).
If you're using salt+peanuts+password to create the password hash, then I'd say that your design is safer than 80% of the systems out there - which is to say, reasonably safe without going overboard with paranoia.
Note however, that if you're actually storing the password in recoverable form (encrypted or plaintext), you're throwing any security out of the window - the whole point of salts and hashing is that you are not storing the password in recoverable form. If you do store the password, that is the weakest link of your system, which is then completely insecure. To make things clear: the user table should only contain the salt and hash of salt+peanuts+password, never the password itself.
您想要存储 1) 每个用户的盐和 2) 哈希密码+盐的结果。您不想存储密码本身。
You want to store 1) the per-user salt and 2) the result of hashing password+salt). You do not want to store the password itself.