为什么 Spring 的 BCryptPasswordEncoder 为相同的输入生成不同的输出? [英] Why BCryptPasswordEncoder from Spring generate different outputs for same input?
问题描述
我正在使用 BCryptPasswordEncoder 具有 Spring 安全性.我的期望是对于相同的输入,我将始终获得相同的输出.但是对于相同的输入,我得到不同的输出.您可以使用以下代码片段对其进行测试:
String password = "123456";PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();String encodingPassword = passwordEncoder.encode(password);System.out.print(encodedPassword);
<块引用>
输出:$2a$10$cYLM.qoXpeAzcZhJ3oXRLu9Slkb61LHyWW5qJ4QKvHEMhaxZ5qCPi
输出 2:$2a$10$KEvYX9yjj0f1X3Wl8S.KPuWzSWGyGM9ubI71NOm3ZNbJcwWN6agvW
输出 3:$2a$10$nCmrPtUaOLn5EI73VZ4Ouu1TmkSWDUxxD4N6A.8hPBWg43Vl.RLDC
谁能解释一下,为什么 BCryptPasswordEncoder 表现得像这样?
public static void main(String[] args) {//弹簧 4.0.0org.springframework.security.crypto.password.PasswordEncoder 编码器= 新 org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder();//$2a$10$lB6/PKg2/JC4XgdMDXyjs.dLC9jFNAuuNbFkL9udcXe/EBjxSyqxW//真的//$2a$10$KbQiHKTa1WIsQFTQWQKCiujoTJJB7MCMSaSgG/imVkKRicMPwgN5i//真的//$2a$10$5WfW4uxVb4SIdzcTJI9U7eU4ZwaocrvP.2CKkWJkBDKz1dmCh50J2//真的//$2a$10$0wR/6uaPxU7kGyUIsx/JS.krbAA9429fwsuCyTlEFJG54HgdR10nK//真的//$2a$10$gfmnyiTlf8MDmwG7oqKJG.W8rrag8jt6dNW.31ukgr0.quwGujUuO//真的for (int i = 0; i <5; i++) {//"123456" - 纯文本 - 来自用户界面的用户输入String passwd = encoder.encode("123456");//passwd - 来自数据库的密码System.out.println(passwd);//打印哈希//对所有 5 次迭代都为真System.out.println(encoder.matches("123456", passwd));}}
I am using BCryptPasswordEncoder with Spring security. My expectation was that for the same input I will always get the same output. But for the same input I get different output. You could test it with the code snippet below:
String password = "123456";
PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
String encodedPassword = passwordEncoder.encode(password);
System.out.print(encodedPassword);
output: $2a$10$cYLM.qoXpeAzcZhJ3oXRLu9Slkb61LHyWW5qJ4QKvHEMhaxZ5qCPi
output2: $2a$10$KEvYX9yjj0f1X3Wl8S.KPuWzSWGyGM9ubI71NOm3ZNbJcwWN6agvW
output3: $2a$10$nCmrPtUaOLn5EI73VZ4Ouu1TmkSWDUxxD4N6A.8hPBWg43Vl.RLDC
Could someone explain, why BCryptPasswordEncoder behave like this?
public static void main(String[] args) {
// spring 4.0.0
org.springframework.security.crypto.password.PasswordEncoder encoder
= new org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder();
// $2a$10$lB6/PKg2/JC4XgdMDXyjs.dLC9jFNAuuNbFkL9udcXe/EBjxSyqxW
// true
// $2a$10$KbQiHKTa1WIsQFTQWQKCiujoTJJB7MCMSaSgG/imVkKRicMPwgN5i
// true
// $2a$10$5WfW4uxVb4SIdzcTJI9U7eU4ZwaocrvP.2CKkWJkBDKz1dmCh50J2
// true
// $2a$10$0wR/6uaPxU7kGyUIsx/JS.krbAA9429fwsuCyTlEFJG54HgdR10nK
// true
// $2a$10$gfmnyiTlf8MDmwG7oqKJG.W8rrag8jt6dNW.31ukgr0.quwGujUuO
// true
for (int i = 0; i < 5; i++) {
// "123456" - plain text - user input from user interface
String passwd = encoder.encode("123456");
// passwd - password from database
System.out.println(passwd); // print hash
// true for all 5 iteration
System.out.println(encoder.matches("123456", passwd));
}
}
这篇关于为什么 Spring 的 BCryptPasswordEncoder 为相同的输入生成不同的输出?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!