加盐密码
我确实需要一些关于如何使用随机盐来防止彩虹表攻击的澄清。它只是不适合我。
假设有一个愚蠢的应用程序，要求密码恰好为五个字符或更少，并且使用九个字符的随机盐对这些密码进行加盐。如果我有一个彩虹表，其中预先计算了 14 个或更少字符的所有字符组合的哈希值，那么随机盐如何提供额外的安全性？在这种情况下，随机盐+密码组合的哈希值不会。出现在彩虹表中吗？
我读过很多地方，使用盐会迫使破解器生成一个全新的彩虹表；同样，随机的每个密码盐将需要每个盐有一个新的彩虹表。为什么？
I could really use some clarification as to how using a random salt protects against rainbow table attacks. It just isn't clicking for me.
Suppose there is a dumb application that requires passwords to be exactly five characters or less, and that salts those passswords with a nine-character random salt. If I have a rainbow table that has precomputed hashes of all character combinations 14 characters or less, how does the random salt provide any additional security? In this case won't the hashed value of the random salt + password combo. be present in the rainbow table?
I have read multiple places that using a salt would force the cracker to generate an entirely new rainbow table; similarly, a random per-password salt would require a new rainbow table for each salt. Why?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果有人真的有一个包含所有可能的字符组合的哈希值的彩虹表，那么不，加盐没有任何帮助。但即使假设仅
Az、az、0-9为有效字符，这也是 6214 = 1.2x10< support>25 14 个字符的密码。因此需要 1700 亿 PB 的存储空间。鉴于这是不可行的，攻击者必须拥有一个小得多的表，仅包含最可能的字符串（例如，字典中的所有单词、与数字混合的单词等）。如果你加了盐，那么这个表就没用了。如果盐是固定的（并且已知的），那么攻击者可以重新计算一个新表。但如果每个密码都有不同的盐，那么这也不起作用。
If someone truly has a rainbow table containing the hash of all possible character combinations, then no, salting is of no help. But even assuming just
A-z,a-z,0-9as valid characters, that's 6214 = 1.2x1025 14-character passwords. So that's 170 billion petabytes of storage required.Given that that's not feasible, the attacker must have a much smaller table, containing only the most likely character strings (e.g. all the words in a dictionary, intermingled with numbers, etc.). If you add a salt, then this table becomes useless. If the salt is fixed (and known), then the attacker could recompute a new table. But if each password has a different salt, then that won't work either.
例如，通过对字典中的所有单词创建哈希来查看密码是一种更快但在某种程度上有效的方法。尝试破解密码的人知道他们在寻找什么，并且由于计算速度有限，他们将搜索范围缩小到经常使用的密码。通过使用盐，这些经常使用的单词将永远不会真正用作密码。
One of the faster yet to some extent effective ways to see what a password is by creating a hash on all words in a dictionary, for example. People who try to crack passwords know what they're looking for and due to limited computing speeds they narrow their search down to often used passwords. By using a salt these often used words will never truly be used as a password.