Java中的多重加密技术 [英] Multiple Encryption Technique in Java
问题描述
例如，我使用PBKDF2WithHmacSHA1加密了一个密码。
现在我想使用SHA512进一步加密它（因为它被认为比SHA1好）
方式削弱我的加密？
此外，我应该扭转加密密码以增加安全性吗？
即使 PBKDF2WithHmacSHA1就够了，我宁愿有更多的保护层。这就是为什么我一直在考虑多重加密。但是，目前我并不打算使用BouncyCastle这样的第三方选项。
如果您是具体Java，这将是有帮助的。
谢谢！
所以几件事...
1：使用其他算法对已加密的数据进行加密是安全的
答案：是。它将需要两种算法进行解密，大概不会是攻击者知道什么（或按什么顺序等），所以它是安全的。这不会损害您的数据。
2：我已使用PBKDF2WithHmacSHA1加密密码。
评论：错误。你没有加密。你做了什么是HASHED你的密码。关键的区别是HASH是任意长度的一条数据的固定长度表示。这意味着hello的哈希将与这是一个较长的短语的长度（但不同的内容）完全相同（这假设您使用相同的算法，您是）。假设哈希算法设计正确，那么应该不可能逆向工程，并将原始数据恢复到。另一方面，加密采取任意长度的数据，并且吐出类似长度的随机数据。 通过加密，可以将您的原始数据恢复。
所以，要清楚，你是哈希，而不是加密。这将是一个重要的区别。
3：现在我要进一步加密它使用SHA512（因为它被认为比SHA1更好）将以任何方式削弱我的加密？
答案：如上所述，您是哈希，不加密您的密码。这意味着，一旦您的PBKDF2WithHmacSHA1算法完成，您将有一个字符串可以使用2 ^ 160个可能的组合（来源： PBKDF2WithHmacSHA512与PBKDF2WithHmacSHA1 ）。这意味着您已经创建了一个可能的值（尽管不可否认），然后可以将其输入到PBKDF2WithHmacSHA512或简单SHA512（以较小者为准）。
这是重要的部分。记住，哈希提供了一个数据的代表字符串。由于您已经生成了具有2 ^ 160个可能条目的结果空间的散列，因此通过更强大的散列算法运行的哈斯不会显着增加您的安全性。
4：目前我不打算使用第三方选项，如BouncyCastle。
评论：我不太清楚你的意思，但我会提供一个警告。加密的最大规则之一是：不要自己做。不要写你自己的算法。甚至不要编写自己的标准算法的实现（例如，作为学术活动或某些东西）。相反，使用已知的库（包括在JAVA或第三方中的一个）被正确设计和实用。
5：其他：额外的保护层是件好事反转密码是你可以做的一件事情;另一种流行（广泛使用）的方法是引入SALT。这只是您在函数中使用的单词或短语（通常存储的明文）。例如，如果你是哈希哈，你可以使用像helloSALT，ShelloALT，helSAloLT这样的盐。这只是额外的数据来引入预先哈希的数据，使它更复杂。理想情况下，只有您的程序才能知道盐如何使用，因此破坏密码会更加困难。 编辑：正如Perseids在下面指出的，SALT是不同的每个密码。您也可以介绍一个PEPPER（是的，盐和胡椒），这是基本相同的，除了PEPPER在整个程序中是不变的。
HOWEVER！
有了这几天电脑的速度，最大的问题就是计算时间。具体来说，它是多么小。 SHA1或甚至SHA512哈希可以非常快地生成，这使得计算机每秒可以生成数百万个哈希，从而可以在BRUTE FORCING您的密码（一件坏事）中取得一些成功。所以，你最理想的是一个算法，需要长的时间来产生（长我的意思是1 - 10ms ....仍然非常快的人类标准，但计算机标准非常慢）。例如，如果你的哈希需要10ms的时间才能生成，那么你每秒只能计算出100个数据....而不是数百个。
输入BCrypt。像SHA512一样，这是一个散列算法。 （它也是文件加密实用程序的名称，尽量不要混淆两者）。 BCrypt是一个自适应算法。它的设计使您可以使计算机变得更加强大，从而使哈希更复杂。而不是详细介绍，我将简单地将您重定向到此在线bcrypt生成器： https： //www.dailycred.com/blog/12/bcrypt-calculator
为了参考，选择4个迭代，散列几乎立即生成，但是选择12次迭代，散列花费了大约2秒的时间来生成 - 生成单个密码的时间很长。演示只能达到12，但是bcrypt支持31.（这个数字是根据网站，而且这个数字可以是任意的，而且意味着别的什么。关键是，使用bcrypt可以配置它花费更长时间来生成哈希 - 攻击者不仅需要更多的时间来生成哈希值，而且需要知道多少重复目标...这是另一个安全层）。
Is it safe to encrypt an already encrypted data using another algorithm?
For instance, I have encrypted a password using "PBKDF2WithHmacSHA1".
Now I want to further encrypt it using "SHA512" (since it is considered better than "SHA1")
Will that in any way weaken my encryption?
Also, should I reverse the encrypted password to increase security?
Even if "PBKDF2WithHmacSHA1" is enough, I would rather have extra layers of protection. That is why I have been thinking of multiple encryption. However, I am not intending to use third-party options such as BouncyCastle at present.
It would be helpful if you are Java specific.
Thank you !
So a few things...
1: "Is it safe to encrypt an already encrypted data using another algorithm"
Answer: yes. It will require two algorithms to decrypt, presumably neither of which the attacker knows (or in what order, etc.), so it is safe. It will not damage your data.
2: " I have encrypted a password using "PBKDF2WithHmacSHA1"."
Comment: Wrong. You have ENCRYPTED nothing. What you have done is HASHED your password. The critical difference is that a HASH is a fixed-length representation of a piece of data of arbitrary length. This means that the hash of "hello" will be exactly the same length (but different content) of "this is a longer phrase" (this assumes you use the same algorithm for both, which you are). Assuming the hash algorithm is designed correctly, it should be impossible to reverse engineer and get your original data back. Encryption, on the other hand, takes in data of arbitrary length, and spits out "random" data of similar length. With encryption, it is possible to get your original data back.
So, to be clear, you are hashing, not encrypting. This will be an important difference in a moment.
3: Now I want to further encrypt it using "SHA512" (since it is considered better than "SHA1") Will that in any way weaken my encryption ?
Answer: As already stated, you're hashing, not encrypting your password. This means that as soon as your PBKDF2WithHmacSHA1 algorithm finishes, you will have a string with 2^160 possible combinations (source: PBKDF2WithHmacSHA512 Vs. PBKDF2WithHmacSHA1). This means that you have created a FINITE (although admittedly large) set of possible values that you can then feed into PBKDF2WithHmacSHA512, or simple SHA512 (whichever).
Here's the important part. Remember, hashing provides a string that is a REPRESENTATIVE of the data. Since you have already generated a hash with a result space of 2^160 possible entries, running that through a more powerful hashing algorithm will NOT significantly increase your security.
4: "I am not intending to use third-party options such as BouncyCastle at present."
Comment: I'm not exactly sure what you mean by this, but I'll provide a word of warning. One of the biggest rules of encryption is: don't do it yourself. DO NOT write your own algorithm. Don't even write your own implementation of a standard algorithm (except as an academic exercise or something, for example). Instead, use a library (either one included with JAVA or a third party) that is KNOWN to be properly designed and functional.
5: Everything else: Extra layers of protection is a good thing. reversing the password is one such thing you can do; another popular (and widely used) method is to introduce a SALT. This is just a word or phrase (typically stored plaintext) that you use in your function. For instance, if you were hashing "hello", you could use a salt like "helloSALT", "ShelloALT", "helSAloLT", etc. It is simply extra data to introduce into the pre-hashed data to make it more complicated. Ideally, only your program would know how the salt got used, and so breaking the password would be much more difficult. EDIT: As Perseids pointed out below, a SALT is different per-password. You can also introduce a PEPPER (yes, salt and pepper), which is essentially the same except that the PEPPER is constant throughout your program.
HOWEVER!
With how fast computers these days are, the biggest problem is COMPUTATION TIME. Specifically, with how SMALL it is. A SHA1, or even a SHA512 hash can be generated VERY quickly, which allows computers to generate millions of them per second, allowing them some success at BRUTE FORCING your password (a bad thing). So, what you ideally want is an algorithm that takes a "long" time to generate (by "long" I mean maybe 1 - 10ms....still very fast by human standards, but very slow by computer standards). For example, if your hash took 10ms to generate, you could only calculate 100 of them per second....not millions.
Enter BCrypt. Like SHA512, this is a hashing algorithm. (It's also the name of a file encryption utility, try not to confuse the two). BCrypt is an ADAPTIVE algorithm. It is designed so that you can make the hashes more complicated as computers get more powerful. Rather than go into detail, I'll simply redirect you to this online bcrypt generator: https://www.dailycred.com/blog/12/bcrypt-calculator
For reference, with 4 iterations selected, the hash generated nearly instantly, but with 12 iterations selected, the hash took around 2 full seconds to generate - a VERY long time to generate a single password. The demo only goes up to 12, but bcrypt supports 31. (This number is according to the website, and that number could be arbitrary, and mean something else. The point is, with bcrypt you can configure it to take longer to generate a hash - The attacker would not only need more time to generate the hash, but they would need to know HOW MANY REPETITIONS to target...which is yet another layer of security).
这篇关于Java中的多重加密技术的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
