如何将 HMAC 密钥不可恢复地存储在数据库中？
我正在尝试为一个系统（由于多种原因）构建一个 API 服务，该系统没有完全安全的主数据库。
所以，我的问题是 - 如何以这样的方式加盐 HMAC，以便即使主数据库受到损害，您仍然无法使用 API 密钥。这实际上意味着 HMAC 密钥不是以明文形式预共享，而是以其他方式预共享，但我不知道如何预共享。
I'm trying to build a API service for a system that (due to many reasons) does not have the main database in a completely secured fashion.
So, my question is - how do I salt the HMAC in such a manner such that even if the main database is compromised, you still cannot use the API key. This effectively means that the HMAC key is not preshared in plaintext but in some other way, but I'm not able to figure out how.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您的存储不安全，您将很难对其进行加密，并且以后仍然能够解密它，除非您将其加密密钥存储在某个地方（根据您的描述，这仍然是不安全的），或者接收密钥从您服务的远程端。
If your storage is insecure, you're going to have an impossible time encrypting it and still being able to decrypt it later unless you either store its encryption key somewhere (which, from your description, would still be insecure), or receive the key from the remote side of your service.