php mysql生成，存儲和匹配密碼和鹽

我有一個名爲pbkdf2.php的文件。php mysql生成，存儲和匹配密碼和鹽

<?php 
/* 
* Password hashing with PBKDF2. 
* Author: havoc AT defuse.ca 
* www: https://defuse.ca/php-pbkdf2.htm 
*/ 

// These constants may be changed without breaking existing hashes. 
define("PBKDF2_HASH_ALGORITHM", "sha256"); 
define("PBKDF2_ITERATIONS", 1000); 
define("PBKDF2_SALT_BYTES", 24); 
define("PBKDF2_HASH_BYTES", 24); 

define("HASH_SECTIONS", 4); 
define("HASH_ALGORITHM_INDEX", 0); 
define("HASH_ITERATION_INDEX", 1); 
define("HASH_SALT_INDEX", 2); 
define("HASH_PBKDF2_INDEX", 3); 

function create_hash($password) 
{ 
    // format: algorithm:iterations:salt:hash 
    $salt = base64_encode(mcrypt_create_iv(PBKDF2_SALT_BYTES, MCRYPT_DEV_URANDOM)); 
    return PBKDF2_HASH_ALGORITHM . ":" . PBKDF2_ITERATIONS . ":" . $salt . ":" . 
     base64_encode(pbkdf2(
      PBKDF2_HASH_ALGORITHM, 
      $password, 
      $salt, 
      PBKDF2_ITERATIONS, 
      PBKDF2_HASH_BYTES, 
      true 
     )); 
} 

function validate_password($password, $good_hash) 
{ 
    $params = explode(":", $good_hash); 
    if(count($params) < HASH_SECTIONS) 
     return false; 
    $pbkdf2 = base64_decode($params[HASH_PBKDF2_INDEX]); 
    return slow_equals(
     $pbkdf2, 
     pbkdf2(
      $params[HASH_ALGORITHM_INDEX], 
      $password, 
      $params[HASH_SALT_INDEX], 
      (int)$params[HASH_ITERATION_INDEX], 
      strlen($pbkdf2), 
      true 
     ) 
    ); 
} 

// Compares two strings $a and $b in length-constant time. 
function slow_equals($a, $b) 
{ 
    $diff = strlen($a)^strlen($b); 
    for($i = 0; $i < strlen($a) && $i < strlen($b); $i++) 
    { 
     $diff |= ord($a[$i])^ord($b[$i]); 
    } 
    return $diff === 0; 
} 

function pbkdf2($algorithm, $password, $salt, $count, $key_length, $raw_output = false) 
{ 
    $algorithm = strtolower($algorithm); 
    if(!in_array($algorithm, hash_algos(), true)) 
     die('PBKDF2 ERROR: Invalid hash algorithm.'); 
    if($count <= 0 || $key_length <= 0) 
     die('PBKDF2 ERROR: Invalid parameters.'); 

    $hash_length = strlen(hash($algorithm, "", true)); 
    $block_count = ceil($key_length/$hash_length); 

    $output = ""; 
    for($i = 1; $i <= $block_count; $i++) { 
     // $i encoded as 4 bytes, big endian. 
     $last = $salt . pack("N", $i); 
     // first iteration 
     $last = $xorsum = hash_hmac($algorithm, $last, $password, true); 
     // perform the other $count - 1 iterations 
     for ($j = 1; $j < $count; $j++) { 
      $xorsum ^= ($last = hash_hmac($algorithm, $last, $password, true)); 
     } 
     $output .= $xorsum; 
    } 

    if($raw_output) 
     return substr($output, 0, $key_length); 
    else 
     return bin2hex(substr($output, 0, $key_length)); 
} 
?>

，我是從here

下載它，我用它如下：

$password = "mypass"; 
$salt = "K3HtAz[|U8][email protected]?Ppj"; 
$hash = pbkdf2("SHA256", $password, $salt, 1, 20);

我讀過一些文章，但不能幫我寫一份給我

我需要在用戶註冊級別生成密碼和鹽，並將它們存儲到MySQL中，當用戶想要登錄時，將它們與登錄表單中的用戶輸入進行匹配..

來源

2013-05-18 AF.P

參見[我剛纔的答覆（HTTP：//計算器.com/questions/10916284/how-to-encrypt-decrypt-data-in-php/10945097＃10945097）關於如何用Bcrypt代替它;它會產生鹽和散列密碼的單個字段。 –

謝謝。我正在閱讀:) –

這是迄今爲止我讀過的最好的一篇文章...非常感謝你 –

應使用此代碼生成：

$password = 'my password'; 
$salt = strtr(base64_encode(openssl_random_pseudo_bytes(18)), '+', '.'); 
$pwhash = crypt($password, sprintf('$2y$%02d$%s', 13, $salt));

而且通過這種方法與之相匹配：

$given_password = $_POST['password']; // the submitted password 
$db_hash = $row['Password']; // field with the password hash 

$given_hash = crypt($given_password, $db_hash); 

if (isEqual($given_hash, $db_hash)) { 
    // user password verified 
} 

// constant time string compare 
function isEqual($str1, $str2) 
{ 
    $n1 = strlen($str1); 
    if (strlen($str2) != $n1) { 
     return false; 
    } 
    for ($i = 0, $diff = 0; $i != $n1; ++$i) { 
     $diff |= ord($str1[$i])^ord($str2[$i]); 
    } 
    return !$diff; 
}

由於this教程

來源

2013-05-18 09:49:11

php mysql生成，存儲和匹配密碼和鹽

回答

相關問題