为什么我不应该使用自己输入的加密盐并使用函数为我随机化盐？
我只是输入一个盐，在 php 文档中，人们总是使用一些随机变量函数。输入盐而不是生成盐有什么缺点？
I am just typing a salt and on php documentations, people always use some random variable function. What is the disadvantage of typing a salt instead of generating it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
为什么强迫您的用户输入某些内容？
随机生成的字节将具有比用户输入（通常仅为字母数字 ASCII）更多的熵。
Why force your users to type something?
Randomly generated bytes will have much more entropy that user input (which is typically only alphanumeric ASCII).
加盐的目的是为哈希添加熵。
加密哈希的设计使得输入的微小变化都会在结果哈希中产生巨大的差异，因此（除非算法中存在缺陷），不可能通过检查两个不同加盐之间的相似性来知道原始输入是否相同哈希值。
但如果你对每个人都使用相同的盐，你就会失去很多好处。 使用相同的盐散列的两个相同的密码将为您提供相同的散列。
如果您对每个人使用相同的盐，那么至少有人可以弄清楚两个用户具有相同的盐密码。
更重要的是，它大大减少了人们破解密码的时间，因为他们现在可以同时检查每个用户的相同哈希值。
最坏的情况是，某人可能已经拥有您使用的盐的查找表，从而使破解每个用户的密码变得微不足道。
虽然可以使用简单的盐（例如用户的 ID）来实现使破解更加困难的目标，但是使用随机字符串只需花费一点点精力，并且会使破解变得更加困难（因为盐几乎不可能提前预测，为该盐预先计算查找表的机会变得更低）。
The point of salt is to add entropy to the hash.
Cryptographic hashes are designed so that a tiny change to the input makes a huge difference in the resulting hash, so (barring a flaw in the algorithm) it becomes impossible to know whether the original input was the same from checking the similarity between two differently salted hashes.
But if you use the same salt for everyone, you lose much of the benefit that provides. Two identical passwords hashed with the same salt will give you the same hash.
If you use the same salt for everyone, then at the very least, someone can figure out that two users have the same password.
More importantly, it greatly lessens the time someone has to spend to crack passwords, since they can now check the same hash against every user at once.
At worst, someone could already have a lookup table for the salt you use, making it trivial to crack every user's password.
While it's possible to use a simple salt (like the user's ID) to achieve the goal of making cracking harder, it's only a tiny bit more effort to use a random string, and makes cracking even harder (since the salt is nearly impossible to predict ahead of time, the chance of having a precomputed lookup table for that salt becomes much lower).