正确实现PHPass [英] Correct implementation of PHPass

问题描述

我正在使用PHPass将用户密码存储在我的应用程序中，因为它比md5或sha1更安全.我有一个关于如何在密码中使用盐的问题.

I'm using PHPass to store users passwords in my application because it's more secure than md5 or sha1. I have a question about how I would use a salt with the passwords.

根据我收集到的信息，当您插入用户时，我会像这样使用它:

From what I gathered, I use it like this when you insert a user:

$pwdHasher = new PasswordHash(8, false);
$hash = $pwdHasher->HashPassword($input_password);

，然后在登录时检查用户详细信息时，您将执行以下操作:

and then when you check the users details on login, you do:

$pwdHasher = new PasswordHash(8, FALSE);
if ($pwdHasher->CheckPassword($input_password, $hash_from_db)) {
    echo 'password correct';
} else {
    echo 'wrong credentials';
}

但是我什么都看不到用盐.根据我的阅读，我的用户表中应该有一个额外的盐字段，用于在对密码进行哈希处理时使用盐，但是PHPass的CheckPassword方法没有盐吗?

But I see nothing there that uses a salt. From what I've read, my user table should have an extra field for a salt that is used when hashing the password, but the CheckPassword method of PHPass doesn't take a salt?

谢谢.

推荐答案

Phpass在对密码进行哈希处理时会添加一个盐，因此无需添加单独的盐并将其存储在数据库中.

Phpass adds a salt when it hashes the password so there's no need to add a separate salt and store it in your database.

这篇关于正确实现PHPass的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！