我應該在數據庫中存儲密碼還是數據庫中的兩個不同的字段？

Question

我想問一下，這個哈希技術對於asp.net是否足夠好？

我計劃在所謂的「密碼」單場保存散列密碼，然後散列登錄頁面上的用戶輸入密碼，看它是否符合

下面是代碼：

public const int SALT_BYTES = 24; 
    public const int HASH_BYTES = 24; 
    public const int PBKDF2_ITERATIONS = 1000; 

    public const int ITERATION_INDEX = 0; 
    public const int SALT_INDEX = 1; 
    public const int PBKDF2_INDEX = 2; 

    /// <summary> 
    /// Creates a salted PBKDF2 hash of the password. 
    /// </summary> 
    /// <param name="password">The password to hash.</param> 
    /// <returns>The hash of the password.</returns> 
    public static string CreateHash(string password) 
    { 
     // Generate a random salt 
     RNGCryptoServiceProvider csprng = new RNGCryptoServiceProvider(); 
     byte[] salt = new byte[SALT_BYTES]; 
     csprng.GetBytes(salt); 

     // Hash the password and encode the parameters 
     byte[] hash = PBKDF2(password, salt, PBKDF2_ITERATIONS, HASH_BYTES); 
     return PBKDF2_ITERATIONS + ":" + 
      Convert.ToBase64String(salt) + ":" + 
      Convert.ToBase64String(hash); 
    } 

    /// <summary> 
    /// Validates a password given a hash of the correct one. 
    /// </summary> 
    /// <param name="password">The password to check.</param> 
    /// <param name="goodHash">A hash of the correct password.</param> 
    /// <returns>True if the password is correct. False otherwise.</returns> 
    public static bool ValidatePassword(string password, string goodHash) 
    { 
     // Extract the parameters from the hash 
     char[] delimiter = { ':' }; 
     string[] split = goodHash.Split(delimiter); 
     int iterations = Int32.Parse(split[ITERATION_INDEX]); 
     byte[] salt = Convert.FromBase64String(split[SALT_INDEX]); 
     byte[] hash = Convert.FromBase64String(split[PBKDF2_INDEX]); 

     byte[] testHash = PBKDF2(password, salt, iterations, hash.Length); 
     return SlowEquals(hash, testHash); 
    } 

    /// <summary> 
    /// Compares two byte arrays in length-constant time. This comparison 
    /// method is used so that password hashes cannot be extracted from 
    /// on-line systems using a timing attack and then attacked off-line. 
    /// </summary> 
    /// <param name="a">The first byte array.</param> 
    /// <param name="b">The second byte array.</param> 
    /// <returns>True if both byte arrays are equal. False otherwise.</returns> 
    private static bool SlowEquals(byte[] a, byte[] b) 
    { 
     uint diff = (uint)a.Length^(uint)b.Length; 
     for (int i = 0; i < a.Length && i < b.Length; i++) 
      diff |= (uint)(a[i]^b[i]); 
     return diff == 0; 
    } 

    /// <summary> 
    /// Computes the PBKDF2-SHA1 hash of a password. 
    /// </summary> 
    /// <param name="password">The password to hash.</param> 
    /// <param name="salt">The salt.</param> 
    /// <param name="iterations">The PBKDF2 iteration count.</param> 
    /// <param name="outputBytes">The length of the hash to generate, in bytes.</param> 
    /// <returns>A hash of the password.</returns> 
    private static byte[] PBKDF2(string password, byte[] salt, int iterations, int outputBytes) 
    { 
     Rfc2898DeriveBytes pbkdf2 = new Rfc2898DeriveBytes(password, salt); 

     pbkdf2.IterationCount = iterations; 
     return pbkdf2.GetBytes(outputBytes); 
    } 

如果我有辦法改進這個功能，如果你能指出我可以替換的某些代碼，那將是非常棒的。

的代碼是：http://crackstation.net/hashing-security.htm#aspsourcecode

先生/女士謝謝++：d

Answer 1

你上面提到的代碼看起來不錯。我沒有找到任何鹽。

我想提到下面的代碼來生成鹽漬HASH。

看看它是否可以幫助你。

''' <summary> 
''' Gets the hash of the string. 
''' </summary> 
''' <param name="pPassword">Provided password to encrypt</param> 
Private Function GetHash(ByVal pPassword As String) As String 
    Dim sHashedString As String 
    dim sSalt1 as string = "YourSalt" 
    dim sSalt2 as string = "YourSalt" 
    Dim sSaltedString = sSalt1 & pPassword & sSalt2 

    Try 
     sHashedString = ConvertByteArrayToString(New System.Security.Cryptography.SHA1CryptoServiceProvider().ComputeHash(System.Text.ASCIIEncoding.ASCII.GetBytes(sSaltedString))) 
    Catch oException As Exception 
     sHashedString = String.Empty 
    End Try 

    Return sHashedString 
End Function 

''' <summary> 
''' Converts the byte array to string. 
''' </summary> 
''' <param name="arrInput">The arr input.</param><returns></returns> 
Private Function ConvertByteArrayToString(ByVal arrInput() As Byte) As String 
    Dim i As Integer 
    Dim sOutput As New System.Text.StringBuilder(arrInput.Length) 

    For i = 0 To arrInput.Length - 1 
     sOutput.Append(arrInput(i).ToString("X2")) 
    Next 

    Return sOutput.ToString() 
End Function 

您可以簡單地提供密碼來生成加密字符串。 與我嘗試的其他功能相比，此功能更輕。 您可以簡單地比較密碼作爲字符串，同時驗證它。無需添加任何其他功能或方法進行驗證。