Unix SALT 如何帮助保护密码？
前几天我在课堂上，我们正在讨论 Unix SALT 以及它如何使密码更难猜测。我的问题是，SALT 以明文形式存储在哈希密码旁边，那么这如何使其更安全呢？我的意思是，如果 SALT 就在那里，那么您将其附加，然后散列您的猜测。另外，关于在彩虹表中预先计算猜测的问题对我来说也没有意义。您只需查看 SALT，然后首先使用给定的 SALT 对其进行预先计算。我能想到的唯一论点是恶意用户无法访问 /etc/password 文件，但是黑客如何知道密码的哈希值。如果有人能指出我正确的方向，我将非常感激。 谢谢！
I was in class the other day and we were talking about Unix SALT and how it makes the passwords much harder to guess. My issue is that the SALT is stored in plaintext right next to the hashed password so how could this make it more secure? I mean if the SALT is right there so you append it and then hash your guess. Also, the issue about precomputing the guesses in a rainbow table doesn't make sense to me either. You would just look at the SALT and first only precompute it with the given SALT. The only argument I can think of is that the malicious user cannot access /etc/password file but then how would the hacker know the hashes of the password. I would really appreciate it if someone could point me in the right direction.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
无需使用盐，您就可以为任何密码预先计算彩虹表。盐将使攻击者必须为每种不同的盐预先计算彩虹表。
有关详细信息，请参阅您可能正在存储密码错误。
Without using a salt, you can precompute a rainbow table for any password. A salt would make the attacker have to precompute a rainbow table for every different salt.
For more information, see You're Probably Storing Passwords Incorrectly.
阅读此中有关使用 Rainbow-tables 进行密码破解的所有内容杰夫·阿特伍德发表的文章。
包含有关“加盐”的信息以及深入研究该主题的链接。
Read all about password hacking using rainbow-tables in this post by Jeff Atwood.
Contains information regarding "salting" as well as links to deep-dive into the subject.