PHP.net 是“任何”的可靠资源吗？ PHP 参考？
修改我的“问题”，以免打扰当地人。
如今，互联网上似乎有如此多的资源（包括在内），找到问题的“一个”答案可能很容易，但如何判断该答案是否有效甚至是最新的？
一个特别被问及的领域是如何使用 PHP 正确处理散列和加密，以便为数据库存储做好准备。关于 SO 的一个常见答案似乎总是“您访问过 php.net 了吗？”。虽然我知道这通常涉及到有人提出最简单问题的问题，但我开始发现一些描述似乎存在冲突，更重要的是，用户示例已经过时（很多是 2008-2009 年的）。
例如：当寻找为什么以及如何使用密码哈希时： http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash
总之，我了解到 sha1 和 md5 是快速且计算高效的方法已经，它们不再适合密码散列。建议的方法是使用 crypt() 函数。
当了解有关 crypt() 的更多信息，特别是河豚哈希时，页面上规定的规则如下：
http://www.php.net/manual/en/function.crypt.php
- 用 $2a$ 开始我的盐
- ，继续使用两个数值（下面的用户已经说明了这一点的重要性，而 php .net 没有)
- 后面跟着 $
- 输入 22字母数字字符
进一步阅读给出了一个示例：
<?php
if (CRYPT_BLOWFISH == 1) {
echo 'Blowfish: ' . crypt('rasmuslerdorf', '$2a$07$usesomesillystringforsalt$') . "\n";
}
?>
同一页面上的示例似乎不遵循它刚刚告诉我们使用的规则（“$2a$07$”后 26 个字符。
返回值为：
河豚：
$2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi
本质上，字符串本身实际上确实被改变了，但几乎我的整个 SALT 值（上面提到的前 22 个字符）都是敞开的。这难道不会让确定我的实际字符串变得更简单吗？
更重要的是，这只是一个例子，但归根结底，应该在多大程度上依赖 PHP.net 等资源？
正如我的朋友穆加图曾经说过的那样“我感觉我正在服用疯狂的药片”。
注意：上述页面是自我最初发布以来进行编辑的，因此我不能保证自我最初的问题和示例提供以来事情没有改变。
Revising my "question" so as not to rustle the natives.
It seems there are so many resources around the internet these days (SO included) that finding "an" answer to a question may be easy, but how to tell if that answer is valid or even up to date?
One area in particular and one that gets asked a lot is how to deal with hashing and encryption properly with PHP for preparation in database storage. One common answer on SO always seems to be "Have you visited php.net yet?". While I understand this typically comes to a question in which somebody asks the simplest of questions, I have started to find some of the descriptions seem to conflict and more importantly, the user examples are outdated (a lot from 2008-2009).
For example: when seeking why and how to use password hashing: http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash
In summary, I learn that sha1 and md5 are fast and computationally efficient methods of hasing, they are no longer suitable for password hashing. The suggested method is to use the crypt() function.
When learning more about crypt() and in particular blowfish hashing, the rules stated on the page are as follows:
http://www.php.net/manual/en/function.crypt.php
- start my salt with $2a$
- continue with two numeric values (user below has stated the significance of this whereas php.net does not)
- follow with a $
- enter 22 alpha-numeric characters
Further reading gives an example of:
<?php
if (CRYPT_BLOWFISH == 1) {
echo 'Blowfish: ' . crypt('rasmuslerdorf', '$2a$07$usesomesillystringforsalt
It seems the example on the same page does not follow the rules it just told us to use (26 characters after "$2a$07$".
The return has is:
Blowfish:
$2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi
essentially, the string itself does in fact get altered but nearly my entire SALT value (the first 22 characters mentioned above) is sitting wide open. Wouldn't this make it somewhat simpler to determine what my actual string was?
More importantly, this is only one example but ultimately, how heavily should resources such as PHP.net be relied upon?
As my friend Mugatu once said "I feel like I'm taking crazy pills".
Note: the pages mentioned above were edited since my original posting so I cannot guarantee things have not changed since my original question and examples provided.
) . "\n";
}
?>
It seems the example on the same page does not follow the rules it just told us to use (26 characters after "$2a$07$".
The return has is:
Blowfish:
$2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi
essentially, the string itself does in fact get altered but nearly my entire SALT value (the first 22 characters mentioned above) is sitting wide open. Wouldn't this make it somewhat simpler to determine what my actual string was?
More importantly, this is only one example but ultimately, how heavily should resources such as PHP.net be relied upon?
As my friend Mugatu once said "I feel like I'm taking crazy pills".
Note: the pages mentioned above were edited since my original posting so I cannot guarantee things have not changed since my original question and examples provided.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
你是对的，互联网（一个美妙而又可怕的地方）充满了关于如何做到这一点的相互矛盾的信息。我有自己的观点（我喜欢 EksBlowfish 进行单向密码哈希），我在 这个无耻、自私的博客插件。
一个重要的注意事项，以防您不点击该链接。
$2a$后面的两个数字不是随机的。它们是 EksBlowfish 在字符串上运行的轮数的 Log-Base-2；基本上，每次将数字增加 1（例如，$2a$07$到$2a$08$），您就会加倍计算哈希值所需的时间。这是设计使然——它使得 EksBlowfish 的计算成本极其昂贵，并且当硬件规模扩大（摩尔定律）时，您可能会使其陷入困境并再次变得昂贵。
正如我的一个好朋友所说，抵御高手的唯一真正方法就是浪费他们的时间。再次，看看这个无耻的、自私的博客插件，如果您想了解有关 (a) EksBlowfish 和 (b) 为什么应该使用它的更多信息；如果您愿意，请跳到文章末尾，获取比我聪明得多的人所写内容的链接。
编辑
至于为什么 PHP 包含 SHA-1 和 MD5 等内容的直接实现，是因为 PHP 不是昨天发明的，它已经（以各种形式）存在了 20 年。 MD5 曾经被认为是安全的。事情发生了变化。
You're right, the internet (being a wonderful and terrible place) is FULL of contradictory information on how you should do this. I have my own opinions (I like EksBlowfish for one-way password hashing) which I outline in this shameless, self-serving blog plug.
One important note, in case you don't follow that link. The two numbers that follow
$2a$are NOT RANDOM. They are the Log-Base-2 of the number of rounds of EksBlowfish to run on the string; basically, every time you increment the number by 1 (e.g.,$2a$07$to$2a$08$), you double the amount of time it takes to calculate the hash.This is by design -- it allows EksBlowfish to be extremely computationally expensive, and when hardware scales up (Moore's law) you can bog it back down and make it expensive again.
As a good friend of mine put it, the only real way to try to fend off a good cracker is to waste their time. Again, check out this shameless, self-serving blog plug if you want more information on (a) EksBlowfish and (b) why you should use it; if you want, skip to the end of the article for links to things written by people who are significantly smarter than I am.
Edit
As for why PHP includes direct implementations of things like SHA-1 and MD5 is because PHP wasn't invented yesterday, it's been around (in various forms) for 20 years. MD5 used to be considered secure. Things change.
sha1 和 md5 等较旧的哈希算法非常适合某些用途，例如对数据进行哈希处理以实现快速检索。虽然它们在加密上不再安全，但它们仍然有用，并且计算速度比 sha256 等更安全的算法快得多。
Sha1 和 Md5 曾经在计算上相对安全，当时通过暴力破解它们在商业上不可行（如果你不是 NSA 或 KGB）。现在，彩虹表或支持 GPU 的强力算法允许任何人将哈希映射到在合理时间内生成该哈希的输入。几年前，情况并非如此。
Older hashing algorithms such as sha1 and md5 are great for some things, such as hashing data for fast retrieval. While the are not cryptographically secure (anymore), they are still useful and are much faster to compute than more-secure algorithms such as sha256.
Sha1 and Md5 were once relatively computationally secure, when it was not commercially feasible (if you weren't the NSA or KGB) to crack them by brute force. Now, a rainbow table or GPU-enabled brute force algorithm allow anyone to map a hash into an input that generates that hash in reasonable time. A few years back, that was not the case.
许多网站（除了那些不知道自己在说什么的网站之外）的问题是，一年前适用的网站仍然很受欢迎，但包含过时的信息。曾经有一段时间，
MD5和SHA1是最先进的哈希算法。不幸的是，现在的情况并非如此。存在许多查找表，可以简单地输入散列并接收工作密钥，或者可以简单地暴力破解它们。同样不幸的是，许多软件包仍然依赖它们，这也是它们仍然存在的原因之一。尽管它们作为安全散列算法存在缺陷，但它们仍然适用于许多情况，例如生成文件校验和。为此使用 MD5 既快速又轻松，并且大多数校验和检查软件仍然支持根据 HD5 和检查文件。
PHP 支持大量的哈希算法。查看
hash()函数，它是也可扩展以支持更新的哈希值。您可以使用hash_algos()了解您的服务器支持什么。就我个人而言，我将 SHA-512 与盐一起使用，因为哈希名称中的数字越大意味着哈希效果越好。正确的？ :)The problem with many sites (besides the ones that have no idea what they're talking about) is that the ones that WERE applicable a year ago are still popular, but contain outdated information. There was a time when
MD5andSHA1were top of the line hashing algorithms. Unfortunately, that is not the case nowadays; numerous lookup tables exist to simply enter a hash and receive a working key, or one could simply brute force their way into them. Also unfortunately, many software packages still rely on them, which is one of the reasons they still exist.Despite their shortcomings as secure hashing algorithms, they are still applicable in many instances such as generating a file checksum. Using MD5 for this is quick and painless, and most checksum checking software still support checking the file against an HD5-sum.
PHP supports a vast array of hashing algorithms. Check out the
hash()function, which is extensible to support newer hashes as well. You can find out what your server supports usinghash_algos(). Personally, I use SHA-512 with a salt, because a bigger number in the hash name means a better hash. Right? :)