如何安全地保存密码，但稍后我需要将其获取为纯文本？
我将创建一项服务，人们可以在其中管理游戏服务器，并且为了管理服务器，我需要管理员密码才能对服务器运行命令。
因此，我需要将密码与服务器 IP 和管理端口一起保存在数据库中，在数据库中我可以获取密码，并在用户想要对服务器执行某些命令时使用它。
我怎样才能尽可能安全地做到这一点？我不想将其以纯文本形式保存在数据库中，并且如果有人获取数据库，我也不希望很容易从保存的哈希值中获取密码。
我使用 ASP.NET MVC 3、C# 和 MySQL 作为数据库。
I going to create a service where people administer the game servers and to administrate the server I need the admin password to run commands to the server.
So I need to save the password with server ip and admin port in a database where I can get out the password and use it when the user wants to do some command to the server.
How I can do this as security as possible? I don't want to save it in plain text in the database and I don't want it to be easy to get the password from the saved hash value if someone gets the database.
I working in ASP.NET MVC 3, C# and MySQL as database.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
看看此链接。三重 DES 加密可以使用密钥进行加密和解密。您的程序将在需要时加密并解密数据库值。如果你想真正安全，你可以考虑使用盐
have a look at this link. Triple DES encryption can be encrypted and decrypted using a key. your program will encrypt on the way up and decrypt the DB value when needed. if you want to really be secure you could look into using a salt
您可以使用公钥加密来存储信息。每个用户都有自己的公钥来加密数据，而您的服务将持有私钥来解密数据。
You could use public-key cryptography to store the information. Each user would have their own public key to encrypt the data, and your service would hold the private key to decrypt the data.
您不需要也不应该获取纯文本密码。您可以使用单向哈希（SHA-1、SHA-2）和盐来存储密码，然后当您输入密码来验证您的凭据时，您将以
相同的方式对输入进行哈希处理您将密码存储在数据库中时所做的操作。如果两个哈希值匹配，则应授予用户访问权限。.Net 有一个 SHA-1 类您可以使用，这样您就不必自己编写。
我重申一下，您不希望能够以纯文本形式获取密码，因为如果您的数据遭到泄露，攻击者也可以获得密码。
You do not need to get the plain text password, nor should you. You could store the password with a 1-way hash (SHA-1, SHA-2) and salt, and then when you enter a password to validate your credentials, you would hash the input the
same waythat you did when you stored the password in the database. If the two hash values match, the user should be granted access..Net has a SHA-1 class that you can use so you do not have to write your own.
I'll reiterate, you do not want to be able to get the password as plain text, because in the event that your data is compromised, the attacker can get the password too.