在 PHP 中对密码加盐
有人可以帮助我吗？我一直在阅读有关对密码加盐以使我的密码更安全的内容。我使用的格式是 salt:password_hashed，所以我的代码是 md5($salt.":".$password_hashed)。 $password_hashed 是原始密码的简单 m5d 字符串，哈希值取自 mktime()。
我不明白盐是如何工作的，我是否也需要将其保存在数据库中？如果盐不断变化，这是如何工作的？
如果用户使用密码“password”注册，并且注册时间为 1234567890（作为 unix 时间戳）。生成的密码将是 md5(mktime().":".$_POST['password']) 或类似的内容。但是，如果用户尝试使用“密码”登录，新创建的盐会有所不同吗？
can someone help me. I've been reading about salting a password to make my passwords more secure. The format I was going with is salt:password_hashed, so my code is md5($salt.":".$password_hashed). $password_hashed is a simple m5d string of the original password, and the hash is taken from mktime().
I don't understand how the salt works, do i need to save this in the database as well? If the salt is ever changing, how does this work?
If a user registered with the password 'password' and the time they registered was 1234567890 (as a unix timestamp). The password generate would be md5(mktime().":".$_POST['password']) or something lik that. But if a user trys to then login with 'password' the newly created salt would be different?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您也必须存储盐，例如，您可以只存储注册日期并将其使用在盐中。
You have to store the salt too, you could for example just store the registrationdate and use that in your salt.
您的盐可以是用户的电子邮件或用户名。
我推荐这种方法：
Your salt can be user's e-mail or username.
I recommend this approach:
盐可以防御彩虹表。保存密码时、创建用户以及更改密码时都会生成盐。您可以将盐作为单独的字段存储在数据库中，但也可以将盐与加密密码连接起来，并将两者存储在一个字段中。由于盐通常具有固定长度，因此以后很容易将两者分开以验证登录密码。
值得注意的是，根据 US-CERT 的说法，md5“被认为在密码学上已被破坏，不适合进一步使用”。您应该改用 sha-256。
Salts defend against rainbow tables. The salt is generated when the password is saved, so when the user is created and whenever the password is changed. You can store the salt as a separate field in your database but you can also just concatenate the salt with the encrypted password, and storing both in one field. Because salts are usually of a fixed length, it's easy to separate the two later to verify a password for login.
It is worth noting that md5 "considered cryptographically broken and unsuitable for further use" according to US-CERT. You should use sha-256 instead.
这真是无稽之谈。没有盐可以使您的密码更安全。
是的
这不起作用。
你觉得怎么样？您不能自己将 mktime() 结果与“1234567890”进行比较（以及生成的哈希值）吗？
That's quite nonsense. No salt can make your password more secure.
yes
It doesn't work.
How do you think? Can't you compare mktime() result with '1234567890' yourself (and resulting hashes as well)?