Java PBKDF2WithHmacSHA512 对比。PBKDF2WithHmacSHA1

PBKDF2WithHmacSHA512 Vs. PBKDF2WithHmacSHA1

提问by DTs

I'm working on a Java authentication subsystem that specs the storage of passwords in the DB as PBKDF2-generated hashes, and I'm now trying to decide whether I should use SHA1or SHA512as PRF. I went through the specs of both but they are very mathematically intensive for me to follow. Can somebody with better crypto-understanding explain how PBKDF2WithHmacSHA512differs from PBKDF2WithHmacSHA1?

我正在开发一个 Java 身份验证子系统，该子系统将数据库中的密码存储指定为PBKDF2生成的哈希，现在我正在尝试决定是否应该使用SHA1或SHA512作为 PRF。我浏览了两者的规格，但它们在数学上非常密集，我可以遵循。有更好的加密理解的人可以解释一下PBKDF2WithHmacSHA512与PBKDF2WithHmacSHA1?

Here's what I'm trying to do:

这是我想要做的：

private static final int HASH_BYTE_SIZE = 64 * 8; // 512 bits
private static final int PBKDF2_ITERATIONS = 1000;      

// generate random salt
SecureRandom random = new SecureRandom();
byte salt[] = new byte[SALT_BYTE_SIZE]; // use salt size at least as long as hash
random.nextBytes(salt);

// generate Hash
PBEKeySpec spec = new PBEKeySpec(password, salt, PBKDF2_ITERATIONS, HASH_BYTE_SIZE);
SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1"); // we would like this to be "PBKDF2WithHmacSHA512" instead? What Provider implements it?
byte[] hash = skf.generateSecret(spec).getEncoded();

// convert hash and salt to hex and store in DB as CHAR(64)...

采纳答案by user2339071

Let us breakdown the word piece by piece:

让我们一块一块地分解这个词：

PBKDF2--WithHmac--SHA512

Let's go over it part by part

让我们一点一点地回顾它

• PBKDF2

  Stands for Password-based-Key-Derivative-Function, a successor of PBKDF1 and is used to implement a pseudorandom function, such as a cryptographic hash, cipher, or HMAC to the input password or passphrase along with a salt value and repeats the process many times to produce a derived key, which can then be used as a cryptographic key in subsequent operations.

• HMAC

  Stands for Keyed-Hash Message Authentication Code (HMAC) is a specific construction for calculating a message authentication code (MAC) involving a cryptographic hash function in combination with a secret cryptographic key. Any cryptographic hash function,may be used in the calculation of an HMAC; the resulting MAC algorithm is termed HMAC-MD5 or HMAC-SHA1 accordingly.

• SHA512

  Well, you know about it.. :P

• PBKDF2

  代表 Password-based-Key-Derivative-Function，它是 PBKDF1 的后继者，用于实现伪随机函数，例如密码散列、密码或 HMAC 到输入密码或密码短语以及盐值并重复该过程多次生成派生密钥，然后可以将其用作后续操作中的加密密钥。

• HMAC

  代表 Keyed-Hash Message Authentication Code (HMAC) 是一种用于计算消息认证码 (MAC) 的特定结构，涉及加密散列函数与秘密加密密钥的组合。任何加密散列函数，都可以用于计算 HMAC；由此产生的 MAC 算法被称为 HMAC-MD5 或 HMAC-SHA1。

• SHA512

  好吧，你知道它.. :P

Now, coming back to your question, the line of code:

现在，回到你的问题，代码行：

SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");

specifies the keyFactory to use the algorithm PDBKDF2WithHmacSHA1. When you would do something like:

指定要使用算法的 keyFactory PDBKDF2WithHmacSHA1。当您执行以下操作时：

SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA512");

you tell the factory to use algorithm PBDKF2WithHmacSHA512.

你告诉工厂使用 algorithm PBDKF2WithHmacSHA512。

Essentialy the main difference between PBKDF2WithHmacSHA1and PBKDF2WithHmacSHA512is that:

本质上，PBKDF2WithHmacSHA1和之间的主要区别在于PBKDF2WithHmacSHA512：

1. The PBKDF2WithHmacSHA1will produce a hash length of 160 bits.
2. The PBKDF2WithHmacSHA512will produce a hash length of 512 bits.

1. 在PBKDF2WithHmacSHA1将产生的160个比特的散列长度。
2. 在PBKDF2WithHmacSHA512将产生的512个比特的散列长度。

Hence the latter is more secure. But there are arguments on both sides as to which is sufficient for encryption. No debate. Just saying.

所以后者更安全。但是对于哪种加密足以满足双方的争论。没有辩论。就是说。

Some additional information about the two algorithms:

关于这两种算法的一些附加信息：

1. HMACSHA1

   HMACSHA1 is a type of keyed hash algorithm that is constructed from the SHA1 hash function and used as an HMAC, or hash-based message authentication code. The HMAC process mixes a secret key with the message data, hashes the result with the hash function, mixes that hash value with the secret key again, and then applies the hash function a second time. The output hash is 160 bits in length.

2. HMACSHA512

   HMACSHA512 is a type of keyed hash algorithm that is constructed from the SHA-512 hash function and used as a Hash-based Message Authentication Code (HMAC). The HMAC process mixes a secret key with the message data and hashes the result. The hash value is mixed with the secret key again, and then hashed a second time. The output hash is 512 bits in length.

1. HMACSHA1

   HMACSHA1 是一种密钥散列算法，由 SHA1 散列函数构造而成，用作 HMAC，或基于散列的消息验证代码。HMAC 过程将密钥与消息数据混合，使用哈希函数对结果进行哈希处理，再次将该哈希值与密钥混合，然后再次应用哈希函数。输出散列的长度为 160 位。

2. HMACSHA512

   HMACSHA512 是一种密钥散列算法，由 SHA-512 散列函数构造而成，用作基于散列的消息身份验证代码 (HMAC)。HMAC 过程将密钥与消息数据混合并散列结果。散列值再次与密钥混合，然后再次散列。输出散列的长度为 512 位。

The main advantage is that HmacWith512is more secure than HmacWith256. For e.g.

主要优点是HmacWith512比HmacWith256. 例如

HMAC_SHA1("key","The quick brown fox jumps over the lazy dog") = 0xde7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9

HMAC_SHA512("key","The quick brown fox jumps over the lazy dog") = 0xb42af09057bac1e2d41708e48a902e09b5ff7f12ab428a4fe86653c73dd248fb82f948a549f7b791a5b41915ee4d1ec3935357e4e2317250d0372afa2ebeeb3a

The difference is pretty huge (as seen). Hope it helps. :)

差异非常大（如所见）。希望能帮助到你。:)

EDIT:As OP mentions

编辑：正如OP提到的

PBEKeySpec(char[] password, byte[] salt, int iterationCount, int keyLength)

The parameter keyLengthis used to indicate the preference on key length for variable-key-size ciphers. The actual key size depends on each provider's implementation. Hence say, doing something like

该参数keyLength用于指示对可变密钥大小密码的密钥长度的偏好。实际密钥大小取决于每个提供程序的实现。因此说，做类似的事情

PBEKeySpec(password, salt, int 100, 512)doesn't mean you will be using SHA1 to generate a keyLength of 512. It simply means that. SHA1 supports upto a maximum of 160 bits. You cannot exceed that.

PBEKeySpec(password, salt, int 100, 512)并不意味着您将使用 SHA1 生成 512 的 keyLength。它只是意味着。SHA1 最多支持 160 位。你不能超过那个。

As for your second question, have a look at the HMAC-SHA1. There are many statements that say algorithms like SHA256is pretty good if you a long hash.

至于你的第二个问题，看看HMAC-SHA1。有很多声明说，SHA256如果你有一个长哈希，算法就好了。

Also, as per the NSA :

此外，根据美国国家安全局：

The NSA specifies that "Elliptic Curve Public Key Cryptography using the 256-bit prime modulus elliptic curve as specified in FIPS-186-2 and SHA-256 are appropriate for protecting classified information up to the SECRET level. Use of the 384-bit prime modulus elliptic curve and SHA-384 are necessary for the protection of TOP SECRET information.

NSA 指定“使用 FIPS-186-2 和 SHA-256 中指定的 256 位素数模椭圆曲线的椭圆曲线公钥密码术适用于保护高达 SECRET 级别的机密信息。使用 384 位素数模椭圆曲线和 SHA-384 是保护绝密信息所必需的。

I think using a HMAC function in conjunction SHA512 is quite secure.

我认为结合 SHA512 使用 HMAC 函数是非常安全的。

回答by Spencer Uresk

SHA512 belongs to the SHA2 family of cryptographic hash functions. Since SHA1 has theoretical weaknesses and SHA512 is slightly slower than SHA1 (slower is better when hashing passwords), SHA512 (or any of the SHA2 family) should be chosen over SHA1 for the purpose of hashing passwords.

SHA512 属于加密哈希函数的 SHA2 系列。由于 SHA1 有理论上的弱点，而且 SHA512 比 SHA1 稍慢（在散列密码时越慢越好），为了散列密码，应该选择 SHA512（或任何 SHA2 系列）而不是 SHA1。

Actually understanding the differences in the functions is not going to be simple, but you might have a better chance of getting an answer on the Crypto SE site.

实际上了解功能的差异并不简单，但您可能有更好的机会在Crypto SE 网站上获得答案。