我的主机提供的最佳哈希算法
我正在寻找一种很好的单方式加密/哈希，以使用主机提供的一种算法来安全地存储密码。
这是主机提供的所有算法的列表： http://wwwww.eresig.tk/hash.php
I am looking for a good one way encryption/hashing for safe storage of passwords using one of the algorithms provided by my host.
Here's a list of all the algoritms provided by the host: http://www.eresig.tk/hash.php
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
以上都不是。通用哈希功能的问题在于它们很快，这意味着攻击者可以很快地实际上很快使用大量密码，并且随着计算机的速度，前景看起来更加隐蔽。
使用 bcrypt 在PHP中，从5.3.0开始支持所有平台。如果您使用的是旧版本的PHP，则可以使用
BCrypt的优点是它具有一个工作因素，您可以将其设置为减慢哈希过程。您不太担心是否要花费更多时间检查给定密码是否有效，但是攻击者需要更长的时间才能进行攻击密码。
如果您想超越这一点，您可能还需要查看 scrypt 。
None of the above. The problem with general purpose hashing functions is that they are fast, which means an attacker could realistically bruteforce a huge amount of passwords very quickly, with the prospect looking bleaker as computers get faster.
Use bcrypt instead, which is built-in to PHP, with support for all platforms starting at 5.3.0. If you are using an older version of PHP, you can set up bcrypt with the Suhosin patch.
The advantage of bcrypt is that it has a work factor which you can set to slow down the hashing process. You are not overly concerned if it takes you a little time more to check if a given password is valid, but it will take an attacker significantly longer to bruteforce passwords.
If you want to go beyond that, you might also want to check out scrypt.
在这个狂热的程序员网站上，散列问题被夸大了。就哈希密码而言，任何算法都足够了。特别是当这个问题与通常的 php 应用程序的其他部分相比时。在普通的 PHP 站点上使用一些强哈希就像在草屋的纸门上使用安全锁一样。
如果您确实希望防止用户密码被网站上的某些漏洞窃取（虽然您应该更加关注此类漏洞），然后暴力破解，然后在其他网站上针对这些用户使用密码，那么您真正应该关心的事情of 是密码强度和盐，而不是哈希算法本身。 没有散列技术可以保护像“1234”或“joe”这样的愚蠢通行证。
因此，
md5 + 强密码 + 平均盐比普通密码 + super-extra-cool_hash更好，而且足够了。Hashing problem is WAY exaggerated on this enthusiast programmers site. In terms of hashing passwords any algorithm would suffice. Especially when this problem compared to other parts of usual php application. Using some strong hash on a usual PHP site is like using a safe lock on a paper door of a straw hut.
If you really want protect user passwords from being stolen using some vulnerability on your site (while such a vulnerability you ought to be way more concerned of) and then bruteforced and then used against these users on other sites, then the thing you really should care of is password strength and salt, not hashing algorithm itself. No hashing technique would protect silly pass like "1234" or "joe".
So,
md5 + strong password + average saltis better thanusual password + super-extra-cool_hashand quite enough.SHA-256足以用于密码哈希，只需确保为每个用户使用不同的编辑盐即可。盐可能是用户的ID，一个“在”时戳上创建的，与该用户相关的GUID等...您在哈希之前将盐附加到纯文本密码上。
执行某种密码“最佳练习”将有助于避免任何蛮力攻击。不允许用户使用弱密码（小于n个字符，仅包含1个字符的字符，等等）。
SHA-256 is more than sufficient for password hashes, just make sure to use a different edit salt for each user. The salt could be the user's ID, a 'created on' time-stamp, a GUID tied to that user, etc... You'd append the salt to the plain text password before hashing.
Enforcing some sort of password 'best practice' would help to avoid any brute-force attacks. Don't allow users to use weak passwords (less than N characters, contains characters from only 1 character set, etc...).