加盐 - 步骤顺序
对密码加盐时，哪种方法是正确的（或最有效的方法）？
A. 首先对密码进行哈希处理，然后用盐对密码进行哈希处理，如下所示：
$password = "passwd";
$salt = "s0merndslt";
$password = sha1($password);
$salty = sha1($password.$salt);
B. 将密码和盐一起进行哈希处理，如下所示：
$password = "passwd";
$salt = "s0merndslt";
$salty = sha1($password.$salt);
如果之前有人问过这个问题，但我找不到答案，我深表歉意到 SO 盐腌的这个特定部分。
When salting a password, which is the correct way (or most effective way)?
A. First hash the password and then hash the hash of the password with the salt like this:
$password = "passwd";
$salt = "s0merndslt";
$password = sha1($password);
$salty = sha1($password.$salt);
B. Take the password and the salt and hash them together like this:
$password = "passwd";
$salt = "s0merndslt";
$salty = sha1($password.$salt);
My apologies if this has been asked before but I could not find the answer to this specific part of salting on SO.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
事实上，无论哪种情况。
但是，您的示例#1 提供了时间权衡，这将（稍微）减慢暴力密码查找器的速度。
随着 GPU 的出现，仅仅对密码进行加盐是不够的。当给定一组要查找的密码时，GPU 支持的暴力密码工具可以在几分钟（甚至几秒钟）内完成短密码。
这就是 bcrypt 或 PBKDF#2 等工具或算法存在的原因：它们多次迭代哈希操作以产生大量工作负载，这使得在商用硬件上从哈希查找密码“不可行”。
如有疑问，请不要实施您自己的密码哈希解决方案！使用 bcrypt 或 PBKDF#2。
In reality, either case.
However, your example #1 provides a time tradeoff which will (slightly) slow down brute force password finders.
With the advent of GPUs, simply salting passwords is not enough. A GPU-backed brute-force password tool, when given a set of passwords to find, can accomplish short passwords in a matter of minutes (or even seconds).
This is why tools or algorithms such as
bcryptor PBKDF#2 exist: they iterate the hashing operation many times to produce a large workload, which makes finding passwords from a hash "infeasible" on commodity hardware.When in doubt, don't implement your own password hash solution! Use
bcryptor PBKDF#2.