保护哈希算法 [英] Securing hashing algorithm

问题描述

大家好！


我们在这里构建应用程序并使用哈希算法通过生成单向哈希来保护

秘密（例如密码）。现在，我已经阅读了很多

并且我已经遵循了大部分有意义的建议。我已经看过一个评论

很多关于确保哈希例程的信息。但没有人解释如何实现这一目标。那么如何确保我的哈希例程呢？我是否使用代码

访问安全性，基于角色的安全性，ACL等或组合？如果

组合哪种组合最好？例程将由两个

应用程序使用。 ASP.NET和Windows应用程序。它已经有一个

强名称，并安装在GAC中。除了我们的两个应用程序之外，我如何通过任何代码阻止它运行

？它应该安装在

GAC中吗？如果没有，我如何保证两个应用程序使用相同的

版本？


感谢您的帮助，

Scott

Hello all!

We are building applications here and have hashing algorithms to secure
secrets (e.g passwords) by producing one way hashes. Now, I''ve read alot
and I''ve followed most of the advice that made sense. One comment I''ve seen
alot about is "securing the hashing routine" but no-one explains how to
accomplish this. So how do I secure my hashing routine? Do I use code
access security, role based security, ACLs, etc or combination? And if
combination what combination is the best? The routines will be used by two
"applications." A ASP.NET and a Windows application. It already has a
strong name and is installed in the GAC. How do I prevent it from being run
by any code besides our two applications? Should it be installed in the
GAC? And if not, how to I guarantee the two applications are using the same
version?

Thanks for your help,
Scott

推荐答案

" Wm。斯科特米勒 <钪********** @ spam.killer.wvinsurance.gov>写在

消息新闻：OP ************** @ TK2MSFTNGP10.phx.gbl ...

"Wm. Scott Miller" <Sc**********@spam.killer.wvinsurance.gov> wrote in
message news:OP**************@TK2MSFTNGP10.phx.gbl...

大家好！

我们在这里构建应用程序并使用散列算法通过生成单向哈希来保护密码（例如密码）。现在，我已经阅读了很多
并且我已经遵循了大部分有意义的建议。我看到很多关于确保哈希例行程序的评论。但没有人解释如何实现这一目标。那么如何保护我的哈希例程？

Hello all!

We are building applications here and have hashing algorithms to secure
secrets (e.g passwords) by producing one way hashes. Now, I''ve read alot
and I''ve followed most of the advice that made sense. One comment I''ve seen alot about is "securing the hashing routine" but no-one explains how to
accomplish this. So how do I secure my hashing routine?

Scott


忽略这条建议确保哈希例程 - 发布你的

哈希例程给所有人看，然后才能确定

它是一个*好*算法。


问候

roy

Scott

Disregard that piece of advice "securing the hashing routine" - publish your
hashing routine for all to see, and then and only then can you be sure that
it is a *good* algorithm.

regards
roy

如果你使用微软的散列算法，你不必担心。

它附带SDK。


" Wm。斯科特米勒写道：

If you use microsoft''s hashing algorithms, you dont have to worry about that.
It comes with the SDK.

"Wm. Scott Miller" wrote:

大家好！

我们在这里构建应用程序并使用散列算法通过生成单向散列来保护密码（例如密码） 。现在，我已经阅读了很多
并且我已经遵循了大部分有意义的建议。我已经看过很多关于保护哈希例程的评论。但没有人解释如何实现这一目标。那么如何确保我的哈希例程呢？我是否使用代码访问安全性，基于角色的安全性，ACL等或组合？如果
组合哪种组合最好？这两个例程将由两个
应用程序使用。 ASP.NET和Windows应用程序。它已经具有强大的名称并安装在GAC中。除了我们的两个应用程序之外，我如何防止它被任何代码运行？它应该安装在GAC吗？如果没有，我如何保证两个应用程序使用相同的
版本？

感谢您的帮助，
Scott

Hello all!

We are building applications here and have hashing algorithms to secure
secrets (e.g passwords) by producing one way hashes. Now, I''ve read alot
and I''ve followed most of the advice that made sense. One comment I''ve seen
alot about is "securing the hashing routine" but no-one explains how to
accomplish this. So how do I secure my hashing routine? Do I use code
access security, role based security, ACLs, etc or combination? And if
combination what combination is the best? The routines will be used by two
"applications." A ASP.NET and a Windows application. It already has a
strong name and is installed in the GAC. How do I prevent it from being run
by any code besides our two applications? Should it be installed in the
GAC? And if not, how to I guarantee the two applications are using the same
version?

Thanks for your help,
Scott

当像这样使用单向散列时，你总是有一个问题 - 保证

传递给键控散列的密码/密钥。我假设您使用像HMACSHA1这样的键控

哈希值或密钥型MD5来散列您的秘密。一些选项是：

1）使用混淆器在程序中加密的字符串（最好没有，

但可能不是很好。）

2）通过注册表，文件或智能卡（或其他）中的ACL进行保护。

3）使用DPAPI在操作系统中设置和获取密码。参见
http://msdn.microsoft.com/library/de...l/secmod21.asp


在三者中，DPAPI可能是最好的。当用户使用相同的用户帐户登录时，它仍然不是完美的，因为使用的应用程序可以解密数据。如果你使用机器商店，任何用户都可以解密数据，除非你使用

额外的熵。因此，稍微好一点的方法可能是使用

机器商店，因此本地机器上的任何用户都可以使用您的程序并保持

您的熵在您的程序中加密（通过混淆器加密。）所以

不是黑客需要破解你的程序集来弄清楚你做什么的一般想法，以某种方式解密你的熵（即第二个pw）然后数字

了解如何从DPAPI获取数据以及存储您使用的数据等等。你可以看看，你可以继续跳过箍隐藏数据直到你的蓝色和

仍然没有得到100％的保护。

可能更好的方法是只使用RSA私钥/公钥和客户

知道公钥。这样，你就没有什么需要隐藏的了。你仍然需要保护你的客户端应用程序公钥，所以它不能被一个

黑客公钥等替换。


当然，如果您的代码是普通的.net，黑客可以使用

ildasm和ilasm往返您的代码并删除您的保护并且

公钥在程序集加载时删除强名称检查。只有

才能帮助你使用一个好的东西（我使用并且喜欢

XenoCode，这也会阻止你的程序集上的ildasm）。说明问题

黑客的唯一选择是破解你的代码可能是最好的努力，应该是我想的目标。


-

William Stacey，MVP
http://mvp.support.microsoft.com


" Wm。斯科特米勒 <钪********** @ spam.killer.wvinsurance.gov>写在

消息新闻：OP ************** @ TK2MSFTNGP10.phx.gbl ...

When using one way hashing like this, you always have one issue - securing
the password/key passed to the keyed hash. I assume your using a "keyed"
hash like HMACSHA1 or a keyed MD5 to hash your secret. Some options are:
1) string encrypted in your program using obfuscator (better then nothing,
but probably not great.)
2) Protected via ACLs in registry, file or smartcard (or others).
3) Use DPAPI to set and get your password in the OS. See
http://msdn.microsoft.com/library/de...l/secmod21.asp

Of the three, DPAPI is probably the best. It is still not perfect as a user
logged in using same user account as app used can decrypt the data. If you
use the machine store, any user could decrypt the data unless you use
additional entropy. So possible a slightly better approach may be to use
machine store so any user on local machine could use your program and keep
your "entropy" encrypted in your program (via obfuscator encryption.) So
not a hacker needs to hack your assembly to figure out general idea of what
your doing, somehow decrypt your entropy (i.e. second pw) and then figure
out how to get data from DPAPI and what store your used, etc. As you can
see, you could keep jumping through hoops hiding data until your blue and
still not get 100% protection.
Possibly a better approach is to use RSA private/public key and client only
knows public key. That way, you have nothing you need to hide. You still
need to protect your client apps public key so it can''t be replaced by a
hackers public key, etc.

Naturally, none of this matters if your code is plain .net as hacker can use
ildasm and ilasm to round trip your code and do remove your protections and
public key removing the strong name checking at assembly load time. Only
thing that helps this is obfuscating using a good one (I use and like
XenoCode which also prevents ildasm on your assemblies). Getting to a point
where the only option for the hacker is to hack your code is probably the
best effort and should be the goal I would think.

--
William Stacey, MVP
http://mvp.support.microsoft.com

"Wm. Scott Miller" <Sc**********@spam.killer.wvinsurance.gov> wrote in
message news:OP**************@TK2MSFTNGP10.phx.gbl...

大家好！

我们在这里构建应用程序并使用散列算法通过生成单向哈希来保护密码（例如密码）。现在，我已经阅读了很多
并且我已经遵循了大部分有意义的建议。我看到很多关于确保哈希例行程序的评论。但没有人解释如何实现这一目标。那么如何确保我的哈希例程呢？我是否使用代码访问安全性，基于角色的安全性，ACL等或组合？如果
组合哪种组合最好？这些例程将由
两个应用程序使用。 ASP.NET和Windows应用程序。它已经具有强大的名称并安装在GAC中。除了我们的两个应用程序之外，如何防止它被
运行？它应该安装在GAC吗？如果没有，我如何保证两个应用程序使用
相同的版本？

感谢您的帮助，
Scott

Hello all!

We are building applications here and have hashing algorithms to secure
secrets (e.g passwords) by producing one way hashes. Now, I''ve read alot
and I''ve followed most of the advice that made sense. One comment I''ve seen alot about is "securing the hashing routine" but no-one explains how to
accomplish this. So how do I secure my hashing routine? Do I use code
access security, role based security, ACLs, etc or combination? And if
combination what combination is the best? The routines will be used by two "applications." A ASP.NET and a Windows application. It already has a
strong name and is installed in the GAC. How do I prevent it from being run by any code besides our two applications? Should it be installed in the
GAC? And if not, how to I guarantee the two applications are using the same version?

Thanks for your help,
Scott

这篇关于保护哈希算法的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！