相当于PHP crypt()的golang [英] golang equivalent of PHP crypt()

问题描述

PHP中的这一行代码评估为true

This line of code in PHP evaluates to true

echo '$2a$09$f5561d2634fb28a969f2dO8QeQ70f4bjCnF/.GvPpjj.8jgmtzZP2' == crypt("enter-new-password",'$2a$09$f5561d2634fb28a969f2dO8QeQ70f4bjCnF/.GvPpjj.8jgmtzZP2');

我需要的是Golang中的一个crypt函数，该函数也将评估为true.

What I need is a crypt function in Golang that will also evaluate to true.

尝试1

我尝试过，但是评估为假:

I tried this but it evaluated to false:

import "github.com/nyarla/go-crypt"
log.Println("$2a$09$f5561d2634fb28a969f2dO8QeQ70f4bjCnF/.GvPpjj.8jgmtzZP2" == crypt.Crypt("enter-new-password","$2a$09$f5561d2634fb28a969f2dO8QeQ70f4bjCnF/.GvPpjj.8jgmtzZP2"))

ATTEMPT 2

我还尝试定义和使用在其他地方找到的这个crypt函数，但它也返回false:

I also tried to define and use this crypt function that I found somewhere else, but it also returned false:

package main

import (
    "fmt"
    "unsafe"
)

// #cgo LDFLAGS: -lcrypt
// #define _GNU_SOURCE
// #include <crypt.h>
// #include <stdlib.h>
import "C"

// crypt wraps C library crypt_r
func crypt(key, salt string) string {
    data := C.struct_crypt_data{}
    ckey := C.CString(key)
    csalt := C.CString(salt)
    out := C.GoString(C.crypt_r(ckey, csalt, &data))
    C.free(unsafe.Pointer(ckey))
    C.free(unsafe.Pointer(csalt))
    return out
}

ATTEMPT 3

我也尝试过这样做，但是它似乎不支持CRYPT_BLOWFISH，这是较早的PHP5.3和更早版本使用的:

I also tried this, but it doesn't seem to have support for CRYPT_BLOWFISH, which was what was used by an older PHP5.3 and earlier:

为什么我的crypt包给了我无效的魔术前缀错误?

所以我的问题是:

对于字符串enter-new-password和$2a$09$f5561d2634fb28a969f2dO8QeQ70f4bjCnF/.GvPpjj.8jgmtzZP2，如何使golang crypt函数的行为与PHP crypt函数完全相同?

How do I get a golang crypt function to behave exactly like the PHP crypt function for the strings enter-new-password and $2a$09$f5561d2634fb28a969f2dO8QeQ70f4bjCnF/.GvPpjj.8jgmtzZP2?

推荐答案

尽管我还没有找到与PHP的crypt函数完全相同的"Go crypt function"，但我找到了替代方法.

Although I haven't found an exact "Go crypt function" equivalent of PHP's crypt function, I found an alternative.

以下解决了我的问题

import "golang.org/x/crypto/bcrypt"
// check will be nil if the bcrypt version of "enter-new-password" is the same as the "$2a$09$f5561d2634fb28a969f2dO8QeQ70f4bjCnF/.GvPpjj.8jgmtzZP2" .  Otherwise check will be an error object
check := bcrypt.CompareHashAndPassword([]byte("$2a$09$f5561d2634fb28a969f2dO8QeQ70f4bjCnF/.GvPpjj.8jgmtzZP2"),[]byte("enter-new-password"))
log.Println(check)

golang.org/x/crypto/bcrypt/bcrypt_test.go提供了一些有关如何使用此模块的有用示例.

The golang.org/x/crypto/bcrypt/bcrypt_test.go has some useful examples of how to use this module.

很明显，PHP的crypt函数具有多种对值进行哈希处理的方式，例如sha256，sha512，blowfish等...似乎有很多go lang模块，但是您必须明确说明哈希类型，成本，等等...在我的问题中，$2a$作为哈希值前缀的存在表明使用了一些河豚类型的哈希.我以前的一些尝试都没有考虑到这一点.实际上，尝试3中的模块不支持河豚.

Apparently PHP's crypt function has many different ways of hashing a value, like sha256, sha512, blowfish etc... It seems there are many go lang modules out there, but you have to explicitly state the hash type, the cost, etc... In my question, the existence of $2a$ as a prefix to the hash value suggested the use of some blowfish type hash. Some of my earlier attempts didn't consider this. In fact, the module in attempt 3 does not have support for blowfish.

这篇关于相当于PHP crypt()的golang的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！