blocks|key|5171440|text|MD5或SHA1+%2B盐。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5171441|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/MD5|1|http://en.wikipedia.org/wiki/SHA-1^0|0|3|0|4|4|1|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]|$A|R|B|S|1|T]]|C|$]]|$1|D|3|-4|5|6|7|U|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]]]

<a href="http://en.wikipedia.org/wiki/MD5" rel="noreferrer">MD5</a> or <a href="http://en.wikipedia.org/wiki/SHA-1" rel="noreferrer">SHA1</a> + salt.

blocks|key|2916367|text|如果您使用MD5或SHA1，请使用salt来避免彩虹表黑客攻击。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2916368|在C#中，这很简单：|2916369|MD5CryptoServiceProvider+hasher+=+new+MD5CryptoServiceProvider();
string+addSalt+=+string.Concat(+"ummm+salty+",+password+);
byte[]+hash+=+hasher.ComputeHash(+Encoding.Unicode.GetBytes(+addSalt+)+);|code-block|syntax|javascript|2916370|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

If you use MD5 or SHA1 use a salt to avoid rainbow table hacks.

In C# this is easy:

<pre><code>MD5CryptoServiceProvider hasher = new MD5CryptoServiceProvider();
string addSalt = string.Concat( "ummm salty ", password );
byte[] hash = hasher.ComputeHash( Encoding.Unicode.GetBytes( addSalt ) );
</code></pre>

blocks|key|711021|text|简单：BCrypt。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|711022|entityMap|0|LINK|mutability|MUTABLE|url|http://www.mindrot.org/projects/^0|3|6|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Easy: <a href="http://www.mindrot.org/projects/" rel="noreferrer">BCrypt</a>.

blocks|key|2916547|text|杰夫的You're+probably+storing+passwords+incorrectly文章是关于这个主题的很好的读物。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2916548|entityMap|0|LINK|mutability|MUTABLE|url|http://www.codinghorror.com/blog/archives/000953.html^0|3|19|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Jeff's <a href="http://www.codinghorror.com/blog/archives/000953.html" rel="noreferrer">You're probably storing passwords incorrectly</a> article is excellent reading on this topic.

blocks|key|5171968|text|这是几周前我的一个问题。我们正在将一个大型MIS项目部署到975个不同的地理位置，我们自己的用户凭据存储将用作不同的已实现和正在使用的应用程序集的身份验证器。我们已经提供了基于REST和SOAP的身份验证服务，但客户坚持要能够从其他应用程序访问用户凭据存储，只需一个到相关表或视图的只读视图的DB连接。叹息..。(这种高度耦合的糟糕设计决策是另一个问题的主题)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5171969|这迫使我们坐下来，将我们的盐化和迭代哈希密码存储方案转换为规范，并提供一些不同的语言实现，以便于集成。|5171970|我们称它为相当安全的哈希密码，简称FSHP。用Python，Ruby，PHP5实现，并发布到公共领域。可在http://github.com/bdd/fshp的GitHub上使用、分叉、燃烧或吐痰|offset|length|5171971|FSHP是一种加盐的、迭代散列的密码散列实现。|5171972|设计原理类似于RFC2898中的PBKDF1规范(又称:+PKCS+#5:基于密码的加密规范2.0版。)FSHP允许在SHA-1和SHA-2+(256,384,512)之间选择盐长度、迭代次数和底层密码散列函数。在每个输出的开头自定义元前缀使其可移植，同时让消费者选择自己的密码存储安全基准。|5171973|安全|style|BOLD|5171974|默认FSHP1使用8字节的盐，使用4096次SHA-256散列迭代。-8字节的盐通过将所需空间乘以2%5E64来渲染彩虹表攻击不切实际。-+4096次迭代会导致暴力攻击的代价相当高。-在此版本发布时，还没有针对SHA-256的已知攻击，可以找到计算量少于2%5E128次操作的冲突。|5171975|IMPLEMENTATIONS:|5171976|5171977|Python:使用2.3.5+(w/+hashlib)、2.5.1、2.6.1|unordered-list-item|5171978|Ruby测试:使用1.8.6|5171979|PHP5测试:使用5.2.6|5171980|测试|5171981|非常欢迎每个人创建缺少的语言实现或改进当前的语言实现。|5171982|BASIC+OPERATION+(使用Python)|5171983|>>>+fsh+=+fshp.crypt('OrpheanBeholderScryDoubt')
>>>+print+fsh
{FSHP1%7C8%7C4096}GVSUFDAjdh0vBosn1GUhzGLHP7BmkbCZVH/3TQqGIjADXpc%2B6NCg3g==
>>>+fshp.validate('OrpheanBeholderScryDoubt',+fsh)
True|code-block|syntax|javascript|5171984|自定义加密：|5171985|让我们弱化我们的口令散列方案。-将盐长度从默认值8减少到2。-将迭代轮次从默认值4096减少到10。-选择带有SHA-1的FSHP0作为底层散列算法。|5171986|>>>+fsh+=+fshp.crypt('ExecuteOrder66',+saltlen=2,+rounds=10,+variant=0)
>>>+print+fsh
{FSHP0%7C2%7C10}Nge7yRT/vueEGVFPIxcDjiaHQGFQaQ==|5171987|entityMap|0|LINK|mutability|MUTABLE|url|http://github.com/bdd/fshp|1|2|http://www.faqs.org/rfcs/rfc2898.html^0|0|0|H|4|0|1H|Q|1|0|0|G|6|2|0|0|2|0|0|0|G|0|0|0|0|0|0|0|0|F|G|A|0|0|0|6|0|0|0^^$0|@$1|2|3|4|5|6|7|1T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1U|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1V|8|@]|9|@$F|1W|G|1X|1|1Y]|$F|1Z|G|20|1|21]]|A|$]]|$1|H|3|I|5|6|7|22|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|23|8|@]|9|@$F|24|G|25|1|26]]|A|$]]|$1|L|3|M|5|6|7|27|8|@$F|28|G|29|N|O]]|9|@]|A|$]]|$1|P|3|Q|5|6|7|2A|8|@]|9|@]|A|$]]|$1|R|3|S|5|6|7|2B|8|@$F|2C|G|2D|N|O]]|9|@]|A|$]]|$1|T|3|-4|5|6|7|2E|8|@]|9|@]|A|$]]|$1|U|3|V|5|W|7|2F|8|@]|9|@]|A|$]]|$1|X|3|Y|5|W|7|2G|8|@]|9|@]|A|$]]|$1|Z|3|10|5|W|7|2H|8|@]|9|@]|A|$]]|$1|11|3|12|5|6|7|2I|8|@]|9|@]|A|$]]|$1|13|3|14|5|6|7|2J|8|@]|9|@]|A|$]]|$1|15|3|16|5|6|7|2K|8|@$F|2L|G|2M|N|O]|$F|2N|G|2O|N|O]]|9|@]|A|$]]|$1|17|3|18|5|19|7|2P|8|@]|9|@]|A|$1A|1B]]|$1|1C|3|1D|5|6|7|2Q|8|@$F|2R|G|2S|N|O]]|9|@]|A|$]]|$1|1E|3|1F|5|6|7|2T|8|@]|9|@]|A|$]]|$1|1G|3|1H|5|19|7|2U|8|@]|9|@]|A|$1A|1B]]|$1|1I|3|-4|5|6|7|2V|8|@]|9|@]|A|$]]]|1J|$1K|$5|1L|1M|1N|A|$1O|1P]]|1Q|$5|1L|1M|1N|A|$1O|1P]]|1R|$5|1L|1M|1N|A|$1O|1S]]]]

That was a problem of mine couple of weeks ago.
We were deploying a large MIS project to 975 different geographical locations where our own user credential store will be used as an authenticator for different set of already implemented and in-use applications. We already provided both REST and SOAP based authentication service but customer insisted to be able to reach the user credential store from other applications with just a a DB connection to read-only view of related table or view. Sigh... (this highly coupled bad design decision is a subject of another question).

That forced us to sit and convert our salted and iteratively hashed password storage scheme to a specification and provide some different language implementations for easy integration.

We called it Fairly Secure Hashed Passwords or <a href="http://github.com/bdd/fshp" rel="nofollow noreferrer">FSHP</a> in short.
Implemented it in Python, Ruby, PHP5 and released it to Public Domain. Available to be consumed, forked, flamed or spit on GitHub at <a href="http://github.com/bdd/fshp" rel="nofollow noreferrer">http://github.com/bdd/fshp</a>

FSHP is a salted, iteratively hashed password hashing implementation.

Design principle is similar with <a href="http://www.faqs.org/rfcs/rfc2898.html" rel="nofollow noreferrer">PBKDF1</a> specification in RFC 2898 
(a.k.a: PKCS #5: Password-Based Cryptography Specification Version 2.0.)
FSHP allows choosing the salt length, number of iterations and the
underlying cryptographic hash function among SHA-1 and SHA-2 (256, 384, 512).
Self defining meta prefix at the beginning of every output makes it portable while letting the consumer to choose its own password storage security baseline.

SECURITY:

Default FSHP1 uses 8 byte salts, with 4096 iterations of SHA-256 hashing.
 - 8 byte salt renders rainbow table attacks impractical by multiplying the
 required space with 2^64.
 - 4096 iterations causes brute force attacks to be fairly expensive.
 - There are no known attacks against SHA-256 to find collisions with
 a computational effort of fewer than 2^128 operations at the time of
 this release.

IMPLEMENTATIONS:

<ul>
<li>Python: Tested with 2.3.5 (w/ hashlib), 2.5.1, 2.6.1</li>
<li>Ruby : Tested with 1.8.6</li>
<li>PHP5 : Tested with 5.2.6</li>
</ul>

Everyone is more than welcome to create missing language implementations or
polish the current ones.

BASIC OPERATION (with Python):

<pre><code>&gt;&gt;&gt; fsh = fshp.crypt('OrpheanBeholderScryDoubt')
&gt;&gt;&gt; print fsh
{FSHP1|8|4096}GVSUFDAjdh0vBosn1GUhzGLHP7BmkbCZVH/3TQqGIjADXpc+6NCg3g==
&gt;&gt;&gt; fshp.validate('OrpheanBeholderScryDoubt', fsh)
True
</code></pre>

CUSTOMIZING THE CRYPT:

Let's weaken our password hashing scheme.
 - Decrease the salt length from default 8 to 2.
 - Decrease the iteration round from default 4096 to 10.
 - Select FSHP0 with SHA-1 as the underlying hash algorithm.

<pre><code>&gt;&gt;&gt; fsh = fshp.crypt('ExecuteOrder66', saltlen=2, rounds=10, variant=0)
&gt;&gt;&gt; print fsh
{FSHP0|2|10}Nge7yRT/vueEGVFPIxcDjiaHQGFQaQ==
</code></pre>

blocks|key|5171470|text|使用SHA单向散列算法和唯一的盐。这是我用来在数据库中存储密码的主要算法。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5171471|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/SHA-1^0|2|3|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Use the <a href="http://en.wikipedia.org/wiki/SHA-1" rel="nofollow noreferrer">SHA</a> one way hashing algorithm along with a unique salt. It is the main algorithm I use for storing my passwords in the database.

blocks|key|5171557|text|如果您使用的是SQL+Server，则可以使用HashBytes函数：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5171558|http://msdn.microsoft.com/en-us/library/ms174415.aspx|offset|length|5171559|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|1H|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@$D|O|E|P|1|Q]]|A|$]]|$1|F|3|-4|5|6|7|R|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|C]]]]

If you're using SQL Server, there's the HashBytes function: 

<a href="http://msdn.microsoft.com/en-us/library/ms174415.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/ms174415.aspx</a>

blocks|key|3761036|text|我对MD5或SHA投了第二票。任何主要的web开发语言都内置了计算散列的函数(例如，在PHP中，mcrypt包包含必要的函数)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3761037|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I second the vote for MD5 or SHA with a salt. Any of the major web development languages have functions built-in for computing the hash (in PHP, for example, the mcrypt package contains the necessary functions).

blocks|key|715834|text|您需要使用单向散列算法，如上面建议的SHA-1和salt。我建议这个网站提供更多信息。它包含一些示例代码/实现。http://www.obviex.com/samples/hash.aspx|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|715835|entityMap|0|LINK|mutability|MUTABLE|url|http://www.obviex.com/samples/hash.aspx^0|1K|13|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

You need to be using an uni-directional hash algorithm like SHA-1 suggested above with a salt. I would suggest this site for more information. It includes some sample code / implementation.
<a href="http://www.obviex.com/samples/hash.aspx" rel="nofollow noreferrer">http://www.obviex.com/samples/hash.aspx</a>

blocks|key|711071|text|我认为，更好的安全性的关键是使用动态盐。这意味着您将为每个新用户生成一个随机字符串，并使用该字符串为散列添加盐。当然，您需要将此盐存储在数据库中，以便稍后能够验证密码(我不会以任何方式对其进行加密)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|711072|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

The key to better security, I think, is to use dynamic salts. This means that you generate a random string for each new user and use that string to salt the hash. Of course, you need to store this salt in the database to be able to verify the password later (I don't encrypt it in any way).

blocks|key|715973|text|对于不可逆的加密，我肯定会选择SHA256或SHA1。MD5现在有相当多的冲突，并且已经投入了大量的精力来打破它，所以不是一个很好的使用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|715974|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

For a non-reversible encryption I would most definitely go with SHA256 or SHA1. MD5 has quite a lot of collisions now and a lot of effort has been put into breaking it, so not a good one to use.

blocks|key|2916961|text|如果您想要面向未来的解决方案，我建议您使用SHA256或SHA512。密码学极客世界对MD5感到不安，对SHA1也是如此。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2916962|或者，如果可以，请等待SHA-3|offset|length|2916963|entityMap|0|LINK|mutability|MUTABLE|url|http://csrc.nist.gov/groups/ST/hash/sha-3/index.html^0|0|B|5|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

If you want to future-proof your solution, I'd recommend SHA256 or SHA512. Cryptographic geekworld is getting the jitters about MD5 and, to a slightly lesser extent, SHA1.

Or, if you can, wait for <a href="http://csrc.nist.gov/groups/ST/hash/sha-3/index.html" rel="nofollow noreferrer">SHA-3</a>

blocks|key|5172204|text|我注意到了很多关于如何正确地进行密码散列的困惑，特别是在stackoverflow上。所以我已经写了一个页面，应该可以把所有的东西都弄清楚。这比使用简单的哈希值要多一点。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5172205|更多信息：How+to+do+password+hashing+properly|offset|length|5172206|entityMap|0|LINK|mutability|MUTABLE|url|http://ossbox.com/salted-password-hashing-doing-it-properly.htm^0|0|5|Z|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

I've noticed a lot of confusion about how to do password hashing properly, especially on stackoverflow. So I've written a page that should clear everything up. There's a bit more to it than using a simple hash.

More info: <a href="http://ossbox.com/salted-password-hashing-doing-it-properly.htm" rel="nofollow">How to do password hashing properly</a>

What is a good, simple encryption scheme for protecting passwords in a database? I don't necessarily need anything that's hyper-secure nor do I need anything that's lightning fast, but those things would be nice. Primarily, I just want something that's easy to implement without being terribly slow or insecure.

Simple password encryption

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

在数据库中保护密码的好的、简单的加密方案是什么？我不一定需要任何超安全的东西，也不需要任何闪电般的速度，但这些东西会很好。首先，我只想要一些容易实现的东西，而不是非常慢或不安全。

问简单密码加密
EN

回答 13

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问简单密码加密EN

回答 13

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问简单密码加密
EN