随机盐 +哈希传递或随机盐 + crypt() 已通过？
我正在尝试为我的网站制作一个或多或少安全的登录系统，我没有太多时间来保护事物，所以我一边学习一边学习。想听听一些关于以下哪项更好以及原因的看法。 （或者我在某个地方犯了错误？）
$staticsalt = '$%*#)$*)^A#$#543667ggfdf\#$%x';
$random = md5(uniqid(mt_rand(), true));
$salt = hash('sha512',$random.$_POST['password'].microtime().$staticsalt);
（数据库中不需要 $salt 的地方......）
$password = crypt($_POST['password'], '$2a$12$'.$salt);
或者（数据库中我也需要 $salt 的地方......）
$password = hash('sha512',$salt.$_POST['password']);
I'm trying to make a more or less secure login system for my site, I haven't had much time with securing things so I'm learning as I go along. Wanted to hear some views on which of the following is better and why. (or have I made a mistake somewhere?)
$staticsalt = '$%*#)$*)^A#$#543667ggfdf\#$%x';
$random = md5(uniqid(mt_rand(), true));
$salt = hash('sha512',$random.$_POST['password'].microtime().$staticsalt);
either (where having the $salt in the database won't be necessary...)
$password = crypt($_POST['password'], '$2a$12
or (where I would need the $salt in the database also...)
$password = hash('sha512',$salt.$_POST['password']);
.$salt);
or (where I would need the $salt in the database also...)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
microtime）作为盐的随机种子可能会让您面临一些高级攻击，而更随机的值可以防止这些攻击。我推荐 phpass，它是密码散列系统的一个很好的现有实现。
http://www.openwall.com/phpass/
microtimeas random seed for the salt may open you up to some advanced attacks that a more random value would prevent.I recommend phpass, which is a good existing implementation of a password hashing system.
http://www.openwall.com/phpass/
不要像那样搅碎你的盐。
crypt的 Blowfish 哈希采用 22 个字符的 base64 编码字符串（使用字符 [./0-9A-Za-z]）作为盐，相当于 128 位熵。您用来创建盐的 SHA-512 哈希具有 512 位熵。但您将丢弃其中超过 80% 的内容，因为
crypt现在仅使用 22 个小写十六进制字符。尽管您正在执行所有花哨的随机生成操作，但这只会留下大约 85 位的熵。如果 85 位对你来说足够好，你不妨这样做：
我真的不敢给你任何关于如何生成使用完整 128 位的盐的建议，因为我不是密码学专家。
Don't hash your salt like that.
crypt's Blowfish hashing takes a 22-character base64-encoded string (using characters [./0-9A-Za-z]) for a salt, which amounts to 128 bits of entropy.The SHA-512 hash you're using to create your salt has 512 bits of entropy. But you're throwing away more than 80% of that since
cryptwill now only use 22 lowercase, hexadecimal characters. That leaves you with only about 85 bits of entropy despite all the fancy randomness-generating you're doing.And if 85 bits is good enough for you, you might as well just do something like this:
I don't really dare to give you any advice on how to generate a salt that does use the full 128 bits, since I'm not a cryptography expert.
事实上，没有必要宣传那么多的安全性。您必须了解您的系统的用途。如果只是聊天，那么使用 md5 就可以了。如果是银行系统，那么您必须有一些真正的身份验证系统，我的意思是一些带有盐或代码生成器的卡。
编辑：我不认为有一个好的安全策略。上面的答案很好，我想。
Actualy there is no point to ad so much security. You have to know for what your system is made for. If its just some chat, then you will be fine with md5. If its banking system, well then you must have some real authentication system, i mean some of card with salts or code generator.
EDIT: I dont thing that there is one good security policy. Upper answer is great, thought.