检查密码复杂性：与最后 X 个密码不同
大多数服务、程序等都有各种密码复杂性检查。在没有深入研究此类检查的功效的情况下，我想到了一个可能有趣但也可能存在问题的检查：
“新密码必须与上次的 X 密码不同，有 Y 个字符。”
这将阻止人们使用诸如 Password1! 之类的密码。 ， 密码2！，等等。但如果这样做了，人们就无法对以前使用的密码进行哈希处理 - 它们最多只能被加密......对吗？
对于较小的 Y 和相当短的密码，您可能仍然可以存储哈希并暴力破解新密码的所有 Y 字母变体，但这变得不可行，因为 Y 并且密码长度增加。
我最初的想法是这样的：因为当您更改密码时，您必须提供原始密码，对新密码进行哈希处理并以加密形式存储旧密码。现在它是可逆的。
因此，假设活动密码始终经过哈希处理，是否有更好的方法来做到这一点？这样做是否会增加或降低应用程序的安全性？
Most services, programs, etc. have various password complexity checks. Without delving into the efficacy of such checks, I thought of one that might be interesting, but also potentially problematic check:
"The new password must be Y characters different from the last X passwords."
This would prevent people from using passwords like Password1!, Password2!, and so on. But if that's done, one cannot hash the previously used password - they would be at best encrypted... Right?
For a small Y and a fairly short password, you could probably still store the hash and bruteforce all Y letter variations of the new password, but this gets unfeasible as Y and the password length grows.
My original idea is this: since when you change the password you must provide your original password, hash the new password and store and the old one in encrypted form. Now it's reversible.
So assuming an active password is always hashed, is there a better way to do this? And also does having this in place increase or decrease the security of the application?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我试图将其放入评论中，但我认为这足够重要，可以放入答案。
OP 提出的方案不一定必然违反 CWE-257。该提案不允许系统管理员（比如说）恢复旧密码。
建议使用新密码作为所有旧密码的加密密钥。如果您可以接受客户端而不是服务器上的“新密码验证”，那么这并不比使用密码加密其他任何内容更安全。
因此，“更改密码”小工具将是客户端代码。服务器将发送 N 个早期密码的加密列表，客户端可以使用用户当前的密码对其进行解密，然后使用用户的新密码重新加密。服务器在任何时候都没有足够的信息来确定任何密码，无论是旧的还是新的。只有客户端拥有此信息，但无论如何它都有......不同之处在于，了解您当前密码的攻击者也可以了解您的旧密码。由于得知您当前的密码已经是一场灾难，因此我觉得这并没有那么糟糕。
确实，这并不能防止员工编写自己的密码更改实用程序来绕过密码限制的“攻击”，因为验证不是在服务器端完成的。但我认为这绝不违反 CWE-257。
这实际上是一个相当聪明的想法。
I tried to put this in a comment, but I think this is important enough to put in an answer.
The scheme proposed by OP is not necessarily a violation of CWE-257. The proposal does not allow a system administrator (say) to recover the old passwords.
The proposal is to use the new password as the encryption key for all of the old passwords. If you can live with the "new password verification" living on the client and not the server, then this is no less secure than encrypting anything else using the password.
So the "change password" gadget would be client-side code. The server would send the encrypted list of N earlier passwords, which the client could decrypt with the user's current password and then re-encrypt with the user's new password. At no time does the server have enough information to determine any of the passwords, whether old or new. Only the client has this information, but it has that in any case... The difference being that an attacker who learned your current password could also learn your old passwords. Since learning your current password is already a disaster, this does not strike me as all that much worse.
True, this does not guard against the "attack" of an employee writing their own password change utility to get around the password restrictions, since the validation is not done on the server side. But in no way is this a violation of CWE-257, in my opinion.
It is actually a reasonably clever idea.
您引用的 Oracle 要求规定密码 n 必须与密码 n-1 充分不同，而不是密码 n 必须与所有以前的密码不同。通常，要更改密码，您需要用户输入当前密码作为其中的一部分。因此，您拥有实现该要求所需的一切，并且不需要以可逆的方式存储密码（加密、暴力破解等）。
我知道这并不能直接满足最初提出的要求（与最后的 X 个密码不同），但我的感觉是这是一个虚假的要求。您的要求将需要可逆的密码（机制并不重要），大多数专家都会同意这是不正确的。我相信您只是误解了 Oracle 的要求（如果这确实是问题的根源）。
编辑：
好的，我只是想到了一种无需可逆密码即可实现您所要求的方法。我仍然认为您误解了 Oracle 的要求，而且我实际上不会做我将要描述的事情，但它会满足要求，而无需可逆的密码。
有点傻，不过应该可以满足要求了。
The Oracle requirement you reference says that password n must differ sufficiently from password n-1, not that password n must differ from all previous passwords. Usually to change a password you make the user enter the current password as part of that. So you have everything you need to implement the requirement, and you don't need to store passwords in a reversable fashion (encryption, brute forcing, whatever).
I understand that this doesn't directly address the requirement as originally posed (differ from last X passwords), but my feeling is that it's a bogus requirement. Your requirement would require reversable passwords (the mechanism doesn't matter) and most experts will agree that that's incorrect. I believe you've simply misinterpreted the Oracle requirement, if that's indeed what's driving the question.
EDIT:
OK, I just thought of a way to implement what you're asking for without reversable passwords. I still think you're misinterpreting the Oracle requirement, and I wouldn't actually do what I'm about to describe myself, but it will meet the requirement without reversable passwords.
Goofy, but that should meet the requirement.
加密密码明显违反了CWE-257，因此应该永远不会完成。然而，如果密码过期，用户刚刚登录，则保留该密码的明文。然后强制用户更改密码并计算两者之间的汉明距离。一旦用户提供了足够不同的密码，就对这个新密码进行哈希处理并丢弃纯文本。
编辑：
您可以保留所有旧密码的盐+哈希，以确保用户不会选择他过去使用过的密码。但强制密码与所有密码有 N 个字母不同会削弱整个系统，而且成本高昂，因为需要进行 o(n) 次比较。
Encrypting passwords is a clear violation of CWE-257 and there for should never be done. However in the case of an expired password, the user has just logged in, there for keep the plain text of this password. Then force the user to change the password and calcualte the hamming distance between the two. Once the user provides a password that is different enough, hash this new password and throw away the plain text.
EDIT:
You could keep the salt+hash's of all of the old passwords to make sure the user doesn't pick a password he has in the past. But enforcing that the password is N letters different from all passwords weakens the system as a whole and is expensive as it would require o(n) comparisons.