使用已知的哈希码确定加密算法
我的同事正在使用一个商业程序，该程序对登录密码进行编码并将其存储在某个数据库中。
现在，我正在开发另一个程序来实现其他一些任务，但我希望我的同事使用相同的用户名和密码对该程序进行身份验证，以避免混淆。
问题是，我没有（并且可能永远不会）任何源代码来确定他们使用的加密算法。 我进行了一些测试，发现相同的密码总是会生成长度相同的 24 个字符的哈希码。例如;
1 XeVTgalUq/gJxHtsMjMH5Q==
123456 0Q8UhOcqClGBxpqzooeFXQ==
有什么方法可以确定他们使用了哪种算法？ 提前致谢，
My co-workers are using a commercial program that encodes and stores login passwords on some database.
Now, I'm developing another program to achieve some other tasks, but I want my co-workers to authenticate to this program with their same username and passwords to avoid confusion.
The problem is, I don't have (and probably never will) any source code to determine which encryption algorithm they've used.
I ran some tests and observed that same passwords always produces same hashcodes with 24 characters in length. For example;
1 XeVTgalUq/gJxHtsMjMH5Q==
123456 0Q8UhOcqClGBxpqzooeFXQ==
Is there any way to determine which algorithm they've used ?
Thanks in advance,
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
没有。这就是加密/散列的要点——它应该是不透明的，因此不应该容易进行逆向工程。您唯一能做的就是尝试一些众所周知的哈希算法（例如 SHA-1），并查看哈希值是否与其他程序匹配。但是，无法知道其他程序是否添加了任何“盐”或是否将多个内容哈希在一起，例如用户名+密码或其他方案。所以你在这方面可能不走运。
您可以尝试使用新程序的一个想法：如果用户以前从未登录过，则允许他们使用任何密码第一次登录。告诉用户他们应该使用与其他程序相同的密码。然后，当他们登录时，捕获该值并使用您自己的哈希方案对其进行哈希处理，然后存储该值以供将来登录。因此，最终您将获得您想要的结果（用户可以使用相同的密码），而无需对其他程序的加密方案进行逆向工程。
现在，显然这种方法的缺点是首次登录根本不安全。如果某人在真实用户有机会首次登录之前以该用户身份登录（从而锁定其密码），则可能会劫持其他用户的帐户。因此，只有在新程序中没有预加载可能受到损害的敏感数据时，这才是一个选择。此外，您还需要管理员能够重置用户的密码，以便如果确实发生这种情况，当真实用户报告他们无法登录时，您可以轻松纠正它。
Nope. That is the point of encryption / hashing-- it is supposed to be opaque so that it should not be easy to reverse engineer. The only thing you can do is try a few well-known hash algorithms like SHA-1 and see if the hash values match the other program. But, there's no way to know if the other program added in any "salt" or is hashing together multiple things, e.g. username + password or some other scheme. So you are probably out of luck on that front.
One idea you could try with your new program: if the user has never logged in before, allow them to log in the first time with ANY password. Tell the users that they should use the same password they did with the other program. Then, when they log in, capture that value and hash it using your own hashing scheme, then store that for future logins. So ultimately you would get the result you're aiming for (that users can use their same passwords), without having to reverse engineer the encryption scheme of the other program.
Now, clearly the drawback with this approach is that it is not secure at all for the first login. Someone could hijack another user's account if they logged in as that user before the real user had a chance to log in for the first time (and thereby lock in his password). So this is only an option if there is no sensitive data pre-loaded in the new program that could be compromised. Also you would need the ability for an administrator to reset a users' password so that if this kind of thing did happen, you could correct it easily when the real user reports that they can't log in.