php 最佳加密技术
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/17546826/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Best Encryption technique
提问by Pankaj Jindal
I'm using PHP. I want a safe and fast password encryption system. Hashing a password a million times may be safer, but also slower. How to achieve a good balance between speed and safety? I want to know the best encryption method in php and how to apply it.
我正在使用 PHP。我想要一个安全快速的密码加密系统。将密码散列一百万次可能更安全，但也更慢。如何在速度和安全之间取得良好的平衡？我想知道php中最好的加密方法以及如何应用它。
回答by TimWolla
I recommend using the new PHP 5.5 password API. It provides a secure means of hashing a password, while being fast enough.
我建议使用新的PHP 5.5 密码 API。它提供了一种安全的密码散列方法，同时足够快。
If you don't have PHP 5.5 available there is a polyfillthat works with PHP 5.3.7+: https://github.com/ircmaxell/password_compat
如果你不具备PHP 5.5提供有一个填充工具与PHP 5.3.7+作品：https://github.com/ircmaxell/password_compat
回答by Zevi Sternlicht
回答by Tarik
Use SHA512 http://php.net/manual/en/function.hash.php. SHA512 is not cracked. I suggest to use a salt: Some random string that you append to the password before hashing. This can protect against precomputed rainbow tables but not against dictionary attacks if the attacker gains access to the database containing passwords and salts. SHA512(password + salt) --> hash Store hash and salt in the DB When checking password, retrieve salt corresponding to user, concatenate it with password, hash it and compare it with stored hash. Read here: How long to brute force a salted SHA-512 hash? (salt provided)
使用 SHA512 http://php.net/manual/en/function.hash.php。SHA512 未破解。我建议使用盐：在散列之前附加到密码的一些随机字符串。如果攻击者获得对包含密码和盐的数据库的访问权限，这可以防止预先计算的彩虹表，但不能防止字典攻击。SHA512(password + salt) --> hash 在DB中存储hash和salt 检查密码时，检索用户对应的salt，将其与密码连接，hash并与存储的hash进行比较。在这里阅读：暴力破解加盐 SHA-512 哈希需要多长时间？（提供盐）
Thinking back about your question and particularly about your statement "Hashing a password a million times may be safer, but also slower. How to achieve a good balance between speed and safety". Indeed, repeatedly hashing will protect you against dictionary attacks by making it computationally prohibitively expensive to compute all hashes in a dictionary. I am not teaching you anything here. From the first link I gave you, it took around 46 milliseconds to calculate a SHA512 hash, which is relatively long. Out of hand I can think of the following factors that could influence your decision as you are in an arms race setting: - Increasing computing power (more CPU cores and GPU computations) - Improved Algorithms over time - Amount of money available to the attacker - The value to get out of your site if cracked (if low, it would not be worth the effort) against - Amount of CPU power you have at your disposal As a rule of thumb, I would hash as many times as possible so as to not impact my web site performance. Taking into account the number of logins per seconds, you can roughly calculate the amount of CPU power you can afford to spend without impacting your site performance.
回想一下您的问题，尤其是您的陈述“将密码散列一百万次可能更安全，但也更慢。如何在速度和安全之间取得良好平衡”。事实上，重复散列将使计算字典中的所有散列的计算成本高得令人望而却步，从而保护您免受字典攻击。我在这里不教你任何东西。从我给你的第一个链接来看，计算一个 SHA512 散列大约需要 46 毫秒，这是相对较长的。当您处于军备竞赛环境时，我可以想到以下可能影响您的决定的因素： - 增加计算能力（更多的 CPU 内核和 GPU 计算） - 随着时间的推移改进算法 - 攻击者可用的资金量 -被破解后离开您网站的价值（如果低，它不值得付出努力）反对 - 您可以使用的 CPU 能力量 根据经验，我会尽可能多地散列，以免影响我的网站性能。考虑到每秒的登录次数，您可以粗略计算出您可以在不影响站点性能的情况下花费的 CPU 能力。
One last comment: Assuming hackers already have access to the table containing the user names and hashed passwords, you might at that point be more worried about all the bad things they can do on your site.
最后一条评论：假设黑客已经可以访问包含用户名和散列密码的表，那么您可能会更担心他们可以在您的网站上做的所有坏事。
回答by exussum
your not looking for encryption - your looking for hashing.
你不是在寻找加密 - 你在寻找散列。
I suggest openwalls phpass http://www.openwall.com/phpass/
我建议 openwalls phpass http://www.openwall.com/phpass/
If you are using PHP5.5 they have a password hasing API http://uk3.php.net/password
如果您使用的是 PHP5.5，他们有一个具有 API http://uk3.php.net/password的密码
for more info.
了解更多信息。
MD5 (salt-less) has been used for a while a large number of lookup lists are around, Combined with modern hardware getting 700K + passwords per second it wont take long at all to "reverse" the password.
MD5（无盐）已经使用了一段时间，周围有大量的查找列表，结合每秒获得 700K + 密码的现代硬件，“反转”密码根本不需要很长时间。
With a salt they are more secure, But still can be cracked quickly
用盐它们更安全，但仍然可以快速破解
