将md5密码哈希转换为PHP 5.5 password_hash() [英] Converting md5 password hashes to PHP 5.5 password_hash()
问题描述
PHP 5.5中新的password_hash API很不错，我想在任何地方开始使用它.对于具有较旧数据库的较旧项目，该数据库将密码存储在md5哈希中，那么将旧用户密码迁移到新的，更安全的API的最佳方法是什么?
除了简单地提示用户在下次登录时重设密码(这对用户来说是不切实际的和烦人的)之外，我还考虑过使用现有的md5哈希作为我所有现有用户的password_hash()输入的可能性.为了验证这些用户的密码(在登录期间)，我将其输入转换为md5哈希，然后将其用于password_verify().新用户将可以省去这一额外的步骤.
这是解决这个问题的一种有价值的方法吗?是否有更好的透明迁移方式，使用户不必为密码重置而烦恼，但我可以立即享受更安全的哈希处理带来的好处?
最重要的是，采用现有的md5散列(容易受到暴力破解)并使用password_hash()API对其进行双重散列"是否还具有安全性呢?
在您的login.php(?)中，您将旧密码从MD5转换为bcrypt，并用新密码替换了数据库中的旧MD5哈希. >
伪代码:
$password = $_POST["password"];
if (substr($pwInDatabase, 0, 1) == "$")
{
// Password already converted, verify using password_verify
}
else
{
// User still using the old MD5, update it!
if (md5($password) == $pwInDatabase)
{
$db->storePw(password_hash($password));
}
}
双重哈希不会提高bcrypt的安全性，因为bcrypt itsef是一种单向哈希函数.
注意:MD5生成32个字符的字符串，而password_hash()至少为60.
阅读手册:
如果确实要决定使用 password_hash() 或兼容性包(如果PHP< 5.5) https://github.com/ircmaxell/password_compat/ ，请务必注意，如果您当前的密码列的长度小于60，则需要将其更改为该长度(或更大).手册建议长度为255.
您将需要更改列的长度，并以新的哈希值重新开始，以使其生效.否则，MySQL将静默失败.
The new password_hash API in PHP 5.5 is nice and I'd like to start using it everywhere. Given an older project with an older database where passwords are stored in md5 hashes, what is the best way to go about migrating old user passwords to the new, more secure API?
Apart from simply prompting users to reset their password upon next login (this is impractical and annoying for users) I've thought about the possibility of using current md5 hash as the input to password_hash() for all my existing users. To verify passwords for these users (during login), I'd convert their input to an md5 hash and then use that to password_verify(). New users would be spared this extra step.
Is this a worthwhile way to go about this? Are there any better ways for transparent migration in which users are not nagged about password resets yet I can immediately enjoy the benefits of more secure hashing?
Most importantly, is there even a security benefit in taking existing md5 hashes (which are prone to brute force) and using the password_hash() API to "double-hash" it?
In your login.php (?) you convert the old passwords from MD5 to bcrypt and replace the old MD5 hash in the database with the new one.
Pseudo code:
$password = $_POST["password"];
if (substr($pwInDatabase, 0, 1) == "$")
{
// Password already converted, verify using password_verify
}
else
{
// User still using the old MD5, update it!
if (md5($password) == $pwInDatabase)
{
$db->storePw(password_hash($password));
}
}
Double hashing would not increase the security of bcrypt, as bcrypt itsef is a one-way hashing function.
Nota: MD5 produces a 32 character length string, while password_hash() is a minimum of 60.
Read the manual:
If and when you do decide to use password_hash() or the compatibility pack (if PHP < 5.5) https://github.com/ircmaxell/password_compat/, it is important to note that if your present password column's length is anything lower than 60, it will need to be changed to that (or higher). The manual suggests a length of 255.
You will need to ALTER your column's length and start over with a new hash in order for it to take effect. Otherwise, MySQL will fail silently.
这篇关于将md5密码哈希转换为PHP 5.5 password_hash()的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
