加密/解密方法
我知道关于这个问题还有十几个问题。但我想知道使用 sha1、sha512 等哈希方法对登录系统的密码进行加密是否会更好，或者使用 Mcrypt 密码会更好吗？
我知道使用 sha 等哈希方法加密后解密是不可能的，如果使用 mcrypt 加密则可能。但是使用 mcrypt 是否安全，因为您也可以解密？
I know that there are more than a dozen questions about this. But I want to know if it would be better to encrypt passwords for a login system with hash methods like sha1, sha512 etc or would it be better to use Mcrypt ciphers for this ?
I know that decrypting after encrypting with hash methods like sha it's impossible, and if encrypting using mcrypt it's possible. But is it safe to use mcrypt since you can also decrypt ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
密码不得可恢复。对它们进行哈希处理的目的是确保如果数据库遭到破坏，攻击者无法访问每个密码，从而无法访问每个用户的帐户（以及重复使用该密码的其他服务上的每个帐户）。
Passwords must not be recoverable. The point of hashing them is to make sure that if the database is compromised, the attacker can't get access to every password and thus every user's account (and every account on other services where the password has been reused).
对于稍后不需要明文密码的密码存储，您始终应该使用哈希函数。这样您就可以检查密码，但潜在的攻击者无法找出纯文本密码（当用户始终使用相同的密码时，这是相关的）
For a password storage that you don't need the plaintext passwords lateron you always should use a Hash-Function. That way you can check the passwords, but a potential attacker cannot find out the plain-text passwords (This is relevant when users always use the same password)
密码不得恢复。因此，您需要使用哈希算法。最流行的是MD5和SHA1。我不建议使用 MD5，因为它很容易受到攻击，而且有很多预先生成的哈希值。 SHA1 更好，但它也有一些不足。最安全的是基于
Wikipedia 上有一个很好的安全级别表。如果你选择了，你应该谷歌“对[算法]的碰撞攻击”和[对[算法]的原像攻击”来查看是否存在攻击（维基百科可能已经过时）。
另外，不要忘记加盐。意味着您散列 $string+"Whatever" 而不是 $string。
Passwords must NOT be recoverable. As such, you need to use hash algorithms. The most popular are MD5 and SHA1. I won't suggest using MD5 because it can be easily attacked and there are many pregenerated hashes. SHA1 is better, but it has some, too. The most secure is SHA256/SHA512 (part of SHA2 family) based on this. Although, the problem with the SHA2 family is that it is very much based on SHA1. It is not yet broken, but it can be broken soon. If you have time, you may port one of the algorithms made for the SHA3 competition or a less known algorithm. If you can install extensions, then the SHA3 competitors already have PHP extensions.
A good table for the security level is at the Wikipedia. And if you have chosen, you should google "collision attack on [algorithm]" and [preimage attack on [algorithm]" to see whether is there an attack (Wikipedia might be outdated).
Also, don't forget to salt. That means that you hash the $string+"Whatever" instead of $string.