哈希机制真的安全吗? [英] is hashing mechanism really secure?
问题描述
好吧，我一直看到(和之后)有人说要使用哈希机制将密码存储在数据库中.我真的很担心它的安全性吗?
Well, I have always seen (and following) people saying to use hashing mechanism for storing passwords in database. I am really concerned is it secure?
让我们举个例子.
假设我是黑客，我得到了您的数据库名称，ID和密码.现在，我可以完全访问您的数据库了.
Let's say I am hacker and I got your database name, id and password. Now I have FULL access to your database.
人们所说的密码应该被散列，因为如果有人黑客，密码对黑客是可见的.
What people say passwords should be hashed because if someone hacks, they are visible to hackers.
因此，如果我以select id, password FROM userDetails身份运行查询，我将获得以下数据
so If I run query as select id, password FROM userDetails I will get data as below
++++++++++++++++++++++++++++
+ id + password +
++++++++++++++++++++++++++++
+ id01 + password01 +
+ id02 + password02 +
++++++++++++++++++++++++++++
选项2:带哈希
++++++++++++++++++++++++++++
+ id + password +
++++++++++++++++++++++++++++
+ id01 + hasValue01 +
+ id02 + hasValue02 +
++++++++++++++++++++++++++++
嗯，我还是要说，散列是不安全的.为什么我在下面用Java代码告诉您.
Well, still I say, hashing is insecure. Why I will tell you below with Java code.
PreparedStatement pst = conn.prepareStatement("SELECT id, password FROM userDetails");
ResultSet rs = pst.executeQuery();
String randomPassword = "";
StringBuffer sb;
boolean myPassCheck = true;
while (rs.next()) {
myPassCheck = true;
while (myPassCheck) {
// this will generate random password
randomPassword = generateRandomPassword();
MessageDigest md = MessageDigest.getInstance("MD5");
byte[] array = md.digest(randomPassword.getBytes());
sb = new StringBuffer();
for (int i = 0; i < array.length; ++i) {
sb.append(Integer.toHexString((array[i] & 0xFF) | 0x100).substring(1, 3));
}
if (sb.toString().equals(rs.getString(2))) {
// this is password
myPassCheck = false;
System.out.print("id=" + rs.getString(1) + ", password=" + sb.toString());
}
}
}
这样，我可以打印用户名和密码. (我知道在找不到密码之前，我将不得不生成随机密码).但是，以这种方式，哈希密码机制也将失败.
This way, I can print the username and password. (I know I will have to generate random password till I have not found the password). However in this way, hashing password mechanism also fails.
我也相信这个世界上存在解密器，它将散列数据转换为实际数据.
因此，我在想
我并不是仅在谈论MD5.我选择MD5仅作为示例.我说的是安全密码的任何机制
推荐答案
不，仅使用散列是不安全的，特别是在仅将MD5应用于密码时，因为:
No, just using hash, especially when just applying MD5 to the password, isn't secure because :
- 如果您只是转换密码(通常是几乎一个常用的单词)，则可以使用常用密码的数据库对其进行测试.因此，请始终使用盐，最好使用用户记录中其他恒定部分的组合.有时，您甚至可以通过在Google中键入哈希来找到哈希的来源...
- MD5容易发生冲突，因此即使是散列，也更喜欢SHA 256或更好
- MD5的计算速度很快，因此在蛮力攻击中的测试速度很快
- if you just convert a password (which is frequently almost a common word), it's easy to test it using a database of common passwords. So always use a salt and preferably a combination of other constant parts of the user record. Sometimes you may even find the origin of a hash by typing the hash in Google...
- MD5 is prone to collisions, so even with a hash, prefer SHA 256 or better
- MD5 is fast to compute, so fast to test in a brute force attack
使用哈希机制，但:
- 采用更好的哈希函数，例如 SHA-256或SHA-512
- 散列一个构造的字符串，例如username + 盐 +密码(您可以只要不被其他程序使用，就使用恒盐，对于大多数用途就足够了)
- take a better hash function, for example SHA-256 or SHA-512
- hash a constructed string, for example username+salt+password (you can use a constant salt as long as it's not used by other programs, it's enough for most uses)
注册某人(或更改其密码)的过程是
The process when you register somebody (or somebody changes his password) is
1)将字符串s构造为s = username + salt + password(或类似的函数)
1) to build the string s as s=username+salt+password (or a similar function)
2)将散列构建为SHA256(s)
2) to build the hash as SHA256(s)
3)在数据库中存储用户名，盐(如果不是常量)和哈希值
3) to store in database the username, the salt (if not constant) and the hash
在对用户进行身份验证时，您以相同的方式构建哈希(使用用户提供的用户名和密码以及数据库中包含的盐)，然后将用户名和哈希与数据库中的内容进行比较.您不要反转哈希函数，因为这是不可行的.
When authenticating a user, you build the hash in the same way (using the username and password given by the user and the salt you have in database) and you compare the username and the hash to what you have in database. You don't reverse the hash function, because that's not feasible.
现在关于您的代码:您的方法似乎是生成所有可能的密码，直到与您要猜测的密码具有相同的MD5为止. 这对于合理的密码将不起作用，因为没有足够的时间来测试所有15个字符的组合.
Now regarding your code : your approach seems to be to generate all possible passwords until one has the same MD5 than the password you're trying to guess. This won't work for reasonable passwords because there isn't enough time to test all combinations of 15 characters.
这篇关于哈希机制真的安全吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
