是否使用 RijndaelManaged 对象来充分保护密码以及存储密钥的位置
我正在使用 RijndaelManaged 对象来加密密码并将其存储在我的数据库中。我目前已将键和向量数组硬编码到对象中。显然，这不太好，因为有人可以获得密钥并解密所有密码。保护密码的最佳方法是什么？这些密钥应该存储在哪里才能获得最大程度的保护？
谢谢。
I am using the RijndaelManaged object to encrypt and store passwords in my database. I currently have the key and vector arrays hard coded into the object. Obviously, this is not great because somebody could get the keys and decrypt all the passwords. What is the best way secure passwords and where should these keys be stored for max protection?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您可以安全地存储密钥，那么 Reijndael 会很棒。
但你不能。
一般做法是：根本不存储密码。存储 Pw 的哈希值（+ 用户名 + 盐），并在用户尝试登录时重新计算。
If you could store the keys securely then Reijndael would be great.
But you can't.
The general practice is: don't store the passwords at all. Store a Hash of the Pw ( + username + salt) and recalculate that when the user tries to log in.
我也使用 rijndael 进行加密。我正在做的是在运行时生成密钥和向量，然后将它们存储在单独的存根文件中。为了进行解密，我从存根文件中读取密钥和向量。是的，钥匙仍然有可能被发现，但几乎不可能完全隐藏它们。
最后，考虑使用私有分隔符与密钥和向量混合 - 这样您就可以按分隔符分割并恢复密钥，而外部用户甚至不知道从哪里开始。
I am too using rijndael for encryption purposes. What I am doing is generating my key and vector on runtime, then storing them in a separate stub file. For decryption to occur, I read the key and vector from the stub file. Yes, it is still possible for the keys to be uncovered, but it is nearly impossible to keep them completely hidden.
Lastly, consider using private delimiters to mix in with the key and vector - this way you can split by delimiter and recover your key while an outside user would have no idea where to even begin.