DB中是否需要存盐
我正在尝试附加随机生成的盐以及我的 md5 生成的密码。那么我们如何重新检查加盐密码呢？我们需要将盐和密码一起保存在数据库中吗？这是一个好方法吗？
$pass='password';
$salt = substr(str_shuffle('0123456789abcdefghijklmnopqrstuvwxyz'), 0, 12);
echo md5($pass.$salt);
还请告诉我这是否是正确的腌制方法？？？
i am trying to append a randomly generated salt along with my md5 generated password. So how can we recheck the salted password? DO we need to save salt along with the password in the Db. Is this a good approach.
$pass='password';
$salt = substr(str_shuffle('0123456789abcdefghijklmnopqrstuvwxyz'), 0, 12);
echo md5($pass.$salt);
Also please tell me if this is the proper way of salting???
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
盐的目的是避免彩虹表攻击或预先计算的密码哈希。为了检查旧密码，您需要使用与散列它相同的盐，因此您确实需要将其存储在例如数据库中。
Md5 不是强大的加密哈希，您可能最好使用 bcrypt。有一个免费的 PHP 实现 http://www.openwall.com/phpass/。
这将有更强的加盐和散列。
The point of a salt is to avoid rainbow table attacks, or precomputed password hashes. In order to check the old password, you'll need to use the same salt you hashed it with, so you do need to store it, e.g. in the DB.
Md5 isn't a strong crypto hash, and you are probably best using bcrypt. There is a free PHP implementation http://www.openwall.com/phpass/.
That will have much stronger salting, and hashing.
是的。
另请注意，所有这些浪漫的散列加盐的东西与您的网站安全完全无关
yes.
Also please note that all this romantic hashing-salting stuff has absolutely nothing to do with your site security
有盐就好了。现在，生成和存储它的方式取决于您。您也可以只存储上次登录的日期和时间并将其用作盐 - 这样您就不会显式存储盐，它会随着每次新登录而改变（当然，这也意味着密码哈希总是不同的） ）。这完全取决于你。
您实际上可以有多种盐 - 也许一种或多种来自数据库（MD5(last_login)、SHA1(用户名)...），另一种则硬编码在您的 PHP 应用程序中。
It's good to have a salt. Now, the way you generate and store it is up to you. You could as well just store the date and time of the last login and use it as the salt - this way you don't explicitly store the salt and it changes with each new login (naturally, this also means the password hash is always different). It's totally up to you.
You could actually have several salts - perhaps one or more coming from the database (MD5(last_login), SHA1(username)...), and another one hardcoded in your PHP application.
是的，将
salt存储在数据库中非常重要 - 如果salt在数据库中被泄露，那么用于验证密码的单向加密将会失败，所以不用担心。Yes it is important to store
saltin the database - if thesaltis compromised in the database then the one-way encryption to validate your password will fail so no worries.只要它不是所有密码的共享盐，您就需要将其存储到数据库或从不会更改的值（例如用户 ID）生成它。
您可以在盐字段或哈希本身中执行此操作（请参阅 phpass 以获取良好的实现示例）
简而言之：通常是的！
As long as it is not a shared salt for all passwords you need to store it to the database or generate it from values that won't change (e.x. user id).
You could do this in a salt field or in the hash itself (see phpass for a good implementation example)
In short: Generally yes!
我想说你需要将其保存在数据库中。否则你会如何保存随机盐？
有关更多信息，请检查：http://crackstation.net/hashing-security.html
I would say you need to save it in the database. How else would you save a random salt?
For more info check: http://crackstation.net/hashing-security.html