{"id":2447,"date":"2025-08-01T02:13:43","date_gmt":"2025-07-31T18:13:43","guid":{"rendered":"https:\/\/systw.net\/note\/?p=2447"},"modified":"2025-11-04T01:39:46","modified_gmt":"2025-11-03T17:39:46","slug":"password-hashing-functions","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/2447","title":{"rendered":"Password Hashing Functions"},"content":{"rendered":"\n<p>\u5c08\u70ba\u5bc6\u78bc\u5132\u5b58\u548c\u91d1\u9470\u884d\u751f\u8a2d\u8a08\u7684\u5bc6\u78bc\u96dc\u6e4a\u51fd\u6578\uff08Password Hashing Functions\uff09\uff0c\u5b83\u5011\u6bd4\u901a\u7528\u96dc\u6e4a\u51fd\u6578\uff08\u5982 SHA-256\uff09\u66f4\u9069\u5408\u4fdd\u8b77\u5bc6\u78bc\uff0c\u56e0\u70ba\u5b83\u5011\u5167\u5efa\u9e7d\u503c\uff08Salt\uff09\u3001\u6162\u901f\u8a08\u7b97\uff08\u6297\u66b4\u529b\u7834\u89e3\uff09\u548c\u90e8\u5206\u5177\u8a18\u61b6\u9ad4\u5bc6\u96c6\u7279\u6027\uff08\u6297\u786c\u9ad4\u653b\u64ca\uff09\u3002\u5e38\u898b\u7684\u6709 Bcrypt\u3001PBKDF2 \u3001Scrypt\u3001Argon2  <\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Bcrypt<\/strong><\/h2>\n\n\n\n<p><strong>\u4ecb\u7d39<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>1999 \u5e74\u7531 Niels Provos \u548c David Mazi\u00e8res \u8a2d\u8a08\uff0c\u57fa\u65bc Blowfish \u5c0d\u7a31\u52a0\u5bc6\u6f14\u7b97\u6cd5\u3002<\/li>\n\n\n\n<li>\u5ee3\u6cdb\u61c9\u7528\u65bc Web \u61c9\u7528\uff08\u5982 PHP\u3001Ruby\u3001Node.js\uff09\u7684\u5bc6\u78bc\u5132\u5b58\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u7528\u9014<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7db2\u7ad9\u7528\u6236\u5bc6\u78bc\u5132\u5b58\uff08\u5982\u8cc7\u6599\u5eab\uff09\u3002<\/li>\n\n\n\n<li>\u7c21\u55ae\u6613\u7528\u7684\u5bc6\u78bc\u96dc\u6e4a\u65b9\u6848\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u683c\u5f0f\u8aaa\u660e<\/strong>\uff1a<\/p>\n\n\n\n<p>bcrypt \u7684\u54c8\u5e0c\u8f38\u51fa\u9075\u5faa\u6a21\u7d44\u5316\u5bc6\u78bc\u683c\u5f0f\uff08Modular Crypt Format\uff09 <\/p>\n\n\n\n<p>\u7d50\u69cb\uff1a<code>$2b$&lt;cost&gt;$&lt;salt&gt;&lt;hash&gt;<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>$2b<\/strong>\uff1a\u7b97\u6cd5\u6a19\u8b58\uff0c\u8868\u793a\u4f7f\u7528 bcrypt\uff08\u65e9\u671f\u7248\u672c\u53ef\u80fd\u70ba $2a \u6216 $2y\uff09\u3002\n<ul class=\"wp-block-list\">\n<li>$2a$ \u662f bcrypt \u6f14\u7b97\u6cd5\u7684\u65e9\u671f\u6a19\u8b58\uff0c\u7528\u65bc\u8868\u793a\u4f7f\u7528 Blowfish \u52a0\u5bc6\u6f14\u7b97\u6cd5\u7684\u5bc6\u78bc\u96dc\u6e4a<\/li>\n\n\n\n<li>$2y$ \u662f PHP \u5c08\u70ba\u4fee\u88dc $2a$ \u7684\u554f\u984c\u800c\u5f15\u5165\u7684 bcrypt \u6a19\u8b58<\/li>\n\n\n\n<li>$2b$ \u662f bcrypt \u7684\u53e6\u4e00\u500b\u8b8a\u9ad4\uff0c\u9032\u4e00\u6b65\u4fee\u88dc\u4e86 $2a$ \u548c $2y$ \u7684\u4e00\u4e9b\u554f\u984c<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>&lt;cost&gt;<\/strong>\uff1a\u5de5\u4f5c\u56e0\u5b50\u7684\u5c0d\u6578\uff082 \u9032\u4f4d\uff09\uff0c\u4ee5\u5169\u4f4d\u6578\u5b57\u8868\u793a\uff0c\u4f8b\u5982 12 \u8868\u793a 2^12 \u6b21\u8fed\u4ee3\u3002<\/li>\n\n\n\n<li><strong>&lt;salt&gt;<\/strong>\uff1a22 \u5b57\u5143 Base64 \u7de8\u78bc\u7684 16 \u5b57\u7bc0\u9e7d\u503c\uff08\u4f7f\u7528 .\/A-Za-z0-9 \u5b57\u7b26\u96c6\uff09\u3002<\/li>\n\n\n\n<li><strong>&lt;hash&gt;<\/strong>\uff1a31 \u5b57\u5143 Base64 \u7de8\u78bc\u7684\u54c8\u5e0c\u503c\uff0c\u5305\u542b\u5bc6\u78bc\u8207\u9e7d\u503c\u7684\u8a08\u7b97\u7d50\u679c\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u7bc4\u4f8b<\/strong>\uff1a <code>$2b$12$abcdefghijklmnopqrstuvwxz1234567890abcdefghijk<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7b97\u6cd5\uff1abcrypt<\/li>\n\n\n\n<li>\u6210\u672c\u56e0\u5b50\uff1a12\uff082^12 \u6b21\u8fed\u4ee3\uff09<\/li>\n\n\n\n<li>\u9e7d\u503c\uff1aabcdefghijklmnopqrstuv\uff0822 \u5b57\u5143\uff09<\/li>\n\n\n\n<li>\u54c8\u5e0c\u503c\uff1awxz1234567890abcdefghijk\uff0831 \u5b57\u5143\uff09<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u512a\u7f3a\u9ede<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u512a\u9ede<\/strong>\uff1a\u6210\u719f\u7a69\u5b9a\uff0c\u5be6\u73fe\u7c21\u55ae\uff0c\u666e\u53ca\u5ea6\u9ad8\u3002<\/li>\n\n\n\n<li><strong>\u7f3a\u9ede<\/strong>\uff1a\u8a2d\u8a08\u8f03\u8001\uff081999 \u5e74\uff09\uff0c\u6297\u786c\u9ad4\u653b\u64ca\u80fd\u529b\u6709\u9650\u3002<\/li>\n<\/ul>\n\n\n\n<p><strong>\u5de5\u5177<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li> hashcat\uff1a\u6709 bcrypt \u683c\u5f0f\uff08$2$\u3001$2a$\u3001$2b$\u3001$2y$\u3001$2x$\uff09\u5728 hashcat \u4e2d\u5747\u4f7f\u7528 -m 3200<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>PBKDF2\uff08Password-Based Key Derivation Function 2\uff09<\/strong><\/h2>\n\n\n\n<p><strong>\u4ecb\u7d39<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>2000 \u5e74\u7531 RSA Laboratories \u63d0\u51fa\uff0c\u57fa\u65bc\u73fe\u6709\u96dc\u6e4a\u51fd\u6578\uff08\u5982 SHA-256\uff09\u8a2d\u8a08\u3002<\/li>\n\n\n\n<li>\u7528\u65bc\u5bc6\u78bc\u5132\u5b58\u548c\u91d1\u9470\u884d\u751f\uff0c\u5ee3\u6cdb\u61c9\u7528\u65bc\u52a0\u5bc6\u6a19\u6e96\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u7528\u9014<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5bc6\u78bc\u5132\u5b58\uff08\u5982\u8cc7\u6599\u5eab\uff09\u3002<\/li>\n\n\n\n<li>\u91d1\u9470\u884d\u751f\uff08\u5982 AES \u52a0\u5bc6\u91d1\u9470\uff09\u3002<\/li>\n\n\n\n<li>\u6a19\u6e96\u5316\u61c9\u7528\uff08\u5982 WPA2\u3001TrueCrypt\uff09\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u683c\u5f0f\u8aaa\u660e<\/strong>\uff1a<\/p>\n\n\n\n<p>PBKDF2 \u672c\u8eab\u4e0d\u5b9a\u7fa9\u6a19\u6e96\u7684\u5b57\u7b26\u4e32\u683c\u5f0f\uff0c\u8f38\u51fa\u901a\u5e38\u662f\u539f\u59cb\u4e8c\u9032\u4f4d\u6578\u64da\u6216\u5341\u516d\u9032\u4f4d\u7de8\u78bc\u3002\u5e38\u898b\u61c9\u7528\u4e2d\uff0c\u6703\u5c07\u9e7d\u503c\u3001\u8fed\u4ee3\u6b21\u6578\u548c\u54c8\u5e0c\u503c\u4e00\u8d77\u5b58\u5132\uff0c\u683c\u5f0f\u7531\u5be6\u73fe\u6c7a\u5b9a\u3002 <\/p>\n\n\n\n<p>\u7d50\u69cb\uff1a<code>&lt;algorithm&gt;$&lt;iterations&gt;$&lt;salt&gt;$&lt;hash&gt;<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>&lt;algorithm&gt;<\/strong>\uff1a\u5e95\u5c64\u54c8\u5e0c\u7b97\u6cd5\uff0c\u5982 pbkdf2-sha256\u3002<\/li>\n\n\n\n<li><strong>&lt;iterations&gt;<\/strong>\uff1a\u8fed\u4ee3\u6b21\u6578\uff0c\u5982 100000\u3002<\/li>\n\n\n\n<li><strong>&lt;salt&gt;<\/strong>\uff1aBase64 \u6216\u5341\u516d\u9032\u4f4d\u7de8\u78bc\u7684\u9e7d\u503c\u3002<\/li>\n\n\n\n<li><strong>&lt;hash&gt;<\/strong>\uff1aBase64 \u6216\u5341\u516d\u9032\u4f4d\u7de8\u78bc\u7684\u54c8\u5e0c\u503c\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u7bc4\u4f8b<\/strong>\uff08\u81ea\u5b9a\u7fa9\u683c\u5f0f\uff09\uff1a <\/p>\n\n\n\n<p><code>pbkdf2-sha256$100000$4d0c7b9e8f2a3b4c5d6e7f8091a2b3c4$8c7b9e8f2a3b4c5d6e7f8091a2b3c4d5e6f7a8b9<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7b97\u6cd5\uff1aPBKDF2 with SHA-256<\/li>\n\n\n\n<li>\u8fed\u4ee3\u6b21\u6578\uff1a100,000<\/li>\n\n\n\n<li>\u9e7d\u503c\uff1a4d0c7b9e8f2a3b4c5d6e7f8091a2b3c4\uff0816 \u5b57\u7bc0\uff0c\u5341\u516d\u9032\u4f4d\uff09<\/li>\n\n\n\n<li>\u54c8\u5e0c\u503c\uff1a8c7b9e8f2a3b4c5d6e7f8091a2b3c4d5e6f7a8b9\uff0832 \u5b57\u7bc0\uff0c\u5341\u516d\u9032\u4f4d\uff09<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u512a\u7f3a\u9ede<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u512a\u9ede<\/strong>\uff1a\u6a19\u6e96\u5316\uff08NIST \u8a8d\u53ef\uff09\uff0c\u652f\u63f4\u591a\u7a2e\u96dc\u6e4a\u51fd\u6578\uff0c\u5ee3\u6cdb\u76f8\u5bb9\u3002<\/li>\n\n\n\n<li><strong>\u7f3a\u9ede<\/strong>\uff1a\u8a18\u61b6\u9ad4\u9700\u6c42\u4f4e\uff0c\u6297\u786c\u9ad4\u653b\u64ca\u5f31\uff0c\u9010\u6f38\u88ab Argon2 \u53d6\u4ee3\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Scrypt<\/strong><\/h2>\n\n\n\n<p><strong>\u4ecb\u7d39<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>2009 \u5e74\u7531 Colin Percival \u8a2d\u8a08\uff0c\u6700\u521d\u70ba Tarsnap \u5099\u4efd\u7cfb\u7d71\u958b\u767c\uff0c\u5f8c\u7528\u65bc\u5bc6\u78bc\u5132\u5b58\u548c\u91d1\u9470\u884d\u751f\u3002<\/li>\n\n\n\n<li>\u4ee5\u8a18\u61b6\u9ad4\u5bc6\u96c6\u70ba\u7279\u8272\uff0c\u5c08\u70ba\u6297\u786c\u9ad4\u653b\u64ca\uff08\u5982 GPU\/ASIC\uff09\u6253\u9020\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u7528\u9014<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5bc6\u78bc\u5132\u5b58\uff08\u5982\u7db2\u7ad9\u8cc7\u6599\u5eab\uff09\u3002<\/li>\n\n\n\n<li>\u91d1\u9470\u884d\u751f\uff08\u5982\u52a0\u5bc6\u786c\u789f\uff09\u3002<\/li>\n\n\n\n<li>\u52a0\u5bc6\u8ca8\u5e63\u6316\u7926\uff08\u5982\u840a\u7279\u5e63\uff09\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u683c\u5f0f\u8aaa\u660e<\/strong>\uff1a<\/p>\n\n\n\n<p>scrypt \u6c92\u6709\u6a19\u6e96\u5316\u7684\u5b57\u7b26\u4e32\u683c\u5f0f\uff0c\u8f38\u51fa\u901a\u5e38\u662f\u4e8c\u9032\u4f4d\u6216\u5341\u516d\u9032\u4f4d\u6578\u64da\u3002\u61c9\u7528\u4e2d\u5e38\u81ea\u5b9a\u7fa9\u683c\u5f0f\uff0c\u5305\u542b\u7b97\u6cd5\u3001\u53c3\u6578\u3001\u9e7d\u503c\u548c\u54c8\u5e0c\u503c\u3002 <\/p>\n\n\n\n<p>\u7d50\u69cb\uff1a<code>scrypt$&lt;N&gt;$&lt;r&gt;$&lt;p&gt;$&lt;salt&gt;$&lt;hash&gt;<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>&lt;N&gt;<\/strong>\uff1aCPU\/\u8a18\u61b6\u9ad4\u6210\u672c\uff082 \u7684\u51aa\uff0c\u5982 16384\uff09\u3002<\/li>\n\n\n\n<li><strong>&lt;r&gt;<\/strong>\uff1a\u8a18\u61b6\u9ad4\u584a\u5927\u5c0f\uff08\u5982 8\uff09\u3002<\/li>\n\n\n\n<li><strong>&lt;p&gt;<\/strong>\uff1a\u4e26\u884c\u5ea6\uff08\u5982 1\uff09\u3002<\/li>\n\n\n\n<li><strong>&lt;salt&gt;<\/strong>\uff1aBase64 \u6216\u5341\u516d\u9032\u4f4d\u7de8\u78bc\u7684\u9e7d\u503c\u3002<\/li>\n\n\n\n<li><strong>&lt;hash&gt;<\/strong>\uff1aBase64 \u6216\u5341\u516d\u9032\u4f4d\u7de8\u78bc\u7684\u54c8\u5e0c\u503c\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u7bc4\u4f8b<\/strong>\uff1a<\/p>\n\n\n\n<p><code>scrypt$16384$8$1$4d0c7b9e8f2a3b4c5d6e7f8091a2b3c4$8c7b9e8f2a3b4c5d6e7f8091a2b3c4d5<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7b97\u6cd5\uff1ascrypt<\/li>\n\n\n\n<li>N\uff1a16384\uff082^14\uff09<\/li>\n\n\n\n<li>r\uff1a8<\/li>\n\n\n\n<li>p\uff1a1<\/li>\n\n\n\n<li>\u9e7d\u503c\uff1a4d0c7b9e8f2a3b4c5d6e7f8091a2b3c4\uff08\u5341\u516d\u9032\u4f4d\uff09<\/li>\n\n\n\n<li>\u54c8\u5e0c\u503c\uff1a8c7b9e8f2a3b4c5d6e7f8091a2b3c4d5\uff08\u5341\u516d\u9032\u4f4d\uff09<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u512a\u7f3a\u9ede<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u512a\u9ede<\/strong>\uff1a\u8a18\u61b6\u9ad4\u5bc6\u96c6\uff0c\u6297\u786c\u9ad4\u653b\u64ca\u5f37\u3002<\/li>\n\n\n\n<li><strong>\u7f3a\u9ede<\/strong>\uff1a\u914d\u7f6e\u8907\u96dc\uff0c\u666e\u53ca\u5ea6\u4f4e\u65bc Bcrypt\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Argon2<\/strong><\/h2>\n\n\n\n<p><strong>\u4ecb\u7d39<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>2015 \u5e74\u8d0f\u5f97<strong>\u5bc6\u78bc\u96dc\u6e4a\u7af6\u8cfd\uff08Password Hashing Competition\uff09<\/strong>\uff0c\u7531 Alex Biryukov \u7b49\u8a2d\u8a08\u3002<\/li>\n\n\n\n<li>\u73fe\u4ee3\u5bc6\u78bc\u96dc\u6e4a\u51fd\u6578\u7684\u9996\u9078\uff0c\u53d6\u4ee3 Bcrypt \u548c Scrypt\u3002<\/li>\n\n\n\n<li>\u6709\u4e09\u500b\u8b8a\u9ad4\uff1a<strong>Argon2d<\/strong>\uff08\u6297\u786c\u9ad4\u653b\u64ca\uff09\u3001<strong>Argon2i<\/strong>\uff08\u6297\u5074\u4fe1\u9053\u653b\u64ca\uff09\u3001<strong>Argon2id<\/strong>\uff08\u6df7\u5408\uff0c\u63a8\u85a6\uff09\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u7528\u9014<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5bc6\u78bc\u5132\u5b58\uff08\u7db2\u7ad9\u3001\u61c9\u7528\uff09\u3002<\/li>\n\n\n\n<li>\u91d1\u9470\u884d\u751f\uff08\u52a0\u5bc6\u7cfb\u7d71\uff09\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u683c\u5f0f\u8aaa\u660e<\/strong><\/p>\n\n\n\n<p>Argon2 \u9075\u5faa\u6a19\u6e96\u5316\u7684\u6a21\u7d44\u5316\u5bc6\u78bc\u683c\u5f0f <\/p>\n\n\n\n<p>\u7d50\u69cb\uff1a<code>$&lt;algorithm&gt;$v=&lt;version&gt;$m=&lt;memory&gt;,t=&lt;iterations&gt;,p=&lt;parallelism&gt;$&lt;salt&gt;$&lt;hash&gt;<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>&lt;algorithm&gt;<\/strong>\uff1aargon2i, argon2d \u6216 argon2id\u3002<\/li>\n\n\n\n<li><strong>&lt;version&gt;<\/strong>\uff1a\u7b97\u6cd5\u7248\u672c\uff08\u901a\u5e38\u70ba 19\uff0c\u5373 0x13\uff09\u3002<\/li>\n\n\n\n<li><strong>&lt;memory&gt;<\/strong>\uff1a\u8a18\u61b6\u9ad4\u4f7f\u7528\u91cf\uff08KB\uff09\u3002<\/li>\n\n\n\n<li><strong>&lt;iterations&gt;<\/strong>\uff1a\u8fed\u4ee3\u6b21\u6578\u3002<\/li>\n\n\n\n<li><strong>&lt;parallelism&gt;<\/strong>\uff1a\u4e26\u884c\u57f7\u884c\u7dd2\u6578\u3002<\/li>\n\n\n\n<li><strong>&lt;salt&gt;<\/strong>\uff1aBase64 \u7de8\u78bc\u7684\u9e7d\u503c\u3002<\/li>\n\n\n\n<li><strong>&lt;hash&gt;<\/strong>\uff1aBase64 \u7de8\u78bc\u7684\u54c8\u5e0c\u503c\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u7bc4\u4f8b<\/strong>\uff1a<\/p>\n\n\n\n<p><code>$argon2id$v=19$m=65536,t=3,p=4$4d0c7b9e8f2a3b4c5d6e7f80$8c7b9e8f2a3b4c5d6e7f8091a2b3c4d5<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7b97\u6cd5\uff1aArgon2id<\/li>\n\n\n\n<li>\u7248\u672c\uff1a19<\/li>\n\n\n\n<li>\u8a18\u61b6\u9ad4\uff1a65536 KB\uff0864 MB\uff09<\/li>\n\n\n\n<li>\u8fed\u4ee3\u6b21\u6578\uff1a3<\/li>\n\n\n\n<li>\u4e26\u884c\u5ea6\uff1a4<\/li>\n\n\n\n<li>\u9e7d\u503c\uff1a4d0c7b9e8f2a3b4c5d6e7f80\uff08\u5341\u516d\u9032\u4f4d\uff0cBase64 \u7de8\u78bc\uff09<\/li>\n\n\n\n<li>\u54c8\u5e0c\u503c\uff1a8c7b9e8f2a3b4c5d6e7f8091a2b3c4d5\uff08\u5341\u516d\u9032\u4f4d\uff0cBase64 \u7de8\u78bc\uff09<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>\u512a\u7f3a\u9ede<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u512a\u9ede<\/strong>\uff1a\u6700\u73fe\u4ee3\uff0c\u5b89\u5168\u6027\u6700\u9ad8\uff0c\u9748\u6d3b\u914d\u7f6e\u3002<\/li>\n\n\n\n<li><strong>\u7f3a\u9ede<\/strong>\uff1a\u8f03\u65b0\uff0c\u666e\u53ca\u5ea6\u7a0d\u4f4e\uff0c\u914d\u7f6e\u9700\u5c08\u696d\u77e5\u8b58\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u6bd4\u8f03\u8868\u683c<\/strong><\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u7279\u6027<\/th><th>Bcrypt<\/th><th>PBKDF2<\/th><th>Scrypt<\/th><th>Argon2 (Argon2id)<\/th><\/tr><\/thead><tbody><tr><td><strong>\u8a2d\u8a08\u5e74\u4efd<\/strong><\/td><td>1999<\/td><td>2000<\/td><td>2009<\/td><td>2015<\/td><\/tr><tr><td><strong>\u57fa\u790e\u6f14\u7b97\u6cd5<\/strong><\/td><td>Blowfish<\/td><td>\u4efb\u610f\u96dc\u6e4a\uff08\u5982 SHA-256\uff09<\/td><td>Salsa20\/8<\/td><td>Keccak\uff08SHA-3 \u76f8\u95dc\uff09<\/td><\/tr><tr><td><strong>\u8a18\u61b6\u9ad4\u5bc6\u96c6<\/strong><\/td><td>\u5426\uff08\u4f4e\u8a18\u61b6\u9ad4\uff09<\/td><td>\u5426\uff08\u4f4e\u8a18\u61b6\u9ad4\uff09<\/td><td>\u662f\uff08\u53ef\u8abf\uff09<\/td><td>\u662f\uff08\u53ef\u8abf\uff09<\/td><\/tr><tr><td><strong>\u9e7d\u503c<\/strong><\/td><td>\u5167\u5efa\u96a8\u6a5f\u9e7d\u503c<\/td><td>\u652f\u63f4\u96a8\u6a5f\u9e7d\u503c<\/td><td>\u5167\u5efa\u96a8\u6a5f\u9e7d\u503c<\/td><td>\u5167\u5efa\u96a8\u6a5f\u9e7d\u503c<\/td><\/tr><tr><td><strong>\u8a08\u7b97\u901f\u5ea6<\/strong><\/td><td>\u6162\uff08\u53ef\u8abf\u5de5\u4f5c\u56e0\u5b50\uff09<\/td><td>\u6162\uff08\u53ef\u8abf\u8fed\u4ee3\u6b21\u6578\uff09<\/td><td>\u6162\uff08\u53ef\u8abf\u8a18\u61b6\u9ad4\/\u8fed\u4ee3\uff09<\/td><td>\u6162\uff08\u53ef\u8abf\u8a18\u61b6\u9ad4\/\u8fed\u4ee3\uff09<\/td><\/tr><tr><td><strong>\u5b89\u5168\u6027<\/strong><\/td><td>\u9ad8\uff08\u4f46\u6297\u786c\u9ad4\u653b\u64ca\u5f31\uff09<\/td><td>\u9ad8\uff08\u4f46\u6297\u786c\u9ad4\u653b\u64ca\u5f31\uff09<\/td><td>\u9ad8\uff08\u6297\u786c\u9ad4\u653b\u64ca\uff09<\/td><td>\u6700\u9ad8\uff08\u6297\u786c\u9ad4\u3001\u5074\u4fe1\u9053\uff09<\/td><\/tr><tr><td><strong>\u7528\u9014<\/strong><\/td><td>\u5bc6\u78bc\u5132\u5b58<\/td><td>\u5bc6\u78bc\u5132\u5b58\u3001\u91d1\u9470\u884d\u751f<\/td><td>\u5bc6\u78bc\u5132\u5b58\u3001\u91d1\u9470\u884d\u751f<\/td><td>\u5bc6\u78bc\u5132\u5b58\u3001\u91d1\u9470\u884d\u751f<\/td><\/tr><tr><td><strong>\u666e\u53ca\u5ea6<\/strong><\/td><td>\u5ee3\u6cdb<\/td><td>\u5ee3\u6cdb\uff08\u6a19\u6e96\u5316\u61c9\u7528\uff09<\/td><td>\u4e2d\u7b49\uff08\u52a0\u5bc6\u8ca8\u5e63\u5e38\u898b\uff09<\/td><td>\u65b0\u8208\uff0c\u9010\u6f38\u666e\u53ca<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"> <\/h3>\n\n\n\n<h2 class=\"wp-block-heading\">phpass<\/h2>\n\n\n\n<p><strong>\u4ecb\u7d39<\/strong>\uff1a<br>phpass\uff08Portable PHP Password Hashing Framework\uff09\u662f\u7531 Openwall \u7684 Solar Designer \u65bc 2000 \u5e74\u4ee3\u521d\u958b\u767c\u7684 PHP \u5bc6\u78bc\u96dc\u6e4a\u6846\u67b6\uff0c\u65e8\u5728\u63d0\u4f9b\u5b89\u5168\u3001\u4fbf\u651c\u7684\u5bc6\u78bc\u5132\u5b58\u89e3\u6c7a\u65b9\u6848\u3002\u57fa\u65bc <strong>MD5<\/strong> \u6216 <strong>bcrypt<\/strong>\uff08\u8996\u74b0\u5883\u800c\u5b9a\uff09\u9032\u884c\u591a\u8f2a\u96dc\u6e4a\uff0c\u5ee3\u6cdb\u61c9\u7528\u65bc <strong>WordPress<\/strong> \u548c <strong>Joomla<\/strong> \u7b49 CMS \u7cfb\u7d71\uff0c\u7528\u65bc\u5b89\u5168\u5132\u5b58\u4f7f\u7528\u8005\u5bc6\u78bc\u3002<\/p>\n\n\n\n<p><strong>\u7528\u9014<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7db2\u7ad9\u7528\u6236\u5bc6\u78bc\u5132\u5b58\uff08\u5982 WordPress \u7684 wp_users \u8cc7\u6599\u8868\uff0c\u6216Joomla\u7684jos_users\u8cc7\u6599\u8868\uff09\u3002<\/li>\n\n\n\n<li>\u63d0\u4f9b\u7c21\u55ae\u6613\u7528\u7684\u5bc6\u78bc\u96dc\u6e4a\u548c\u9a57\u8b49\u65b9\u6848\uff0c\u9069\u7528\u65bc\u5404\u7a2e PHP \u61c9\u7528\u3002<\/li>\n<\/ul>\n\n\n\n<p><strong>\u683c\u5f0f\u8aaa\u660e<\/strong>\uff1a<br>phpass \u7684\u96dc\u6e4a\u8f38\u51fa\u9075\u5faa\u5176\u81ea\u5b9a\u7fa9\u683c\u5f0f\uff0c\u652f\u63f4\u591a\u7a2e\u6f14\u7b97\u6cd5\uff0c\u5e38\u7528\u683c\u5f0f\u70ba <code>$P$<\/code>\uff08\u57fa\u65bc MD5\uff09\u6216 <code>$H$<\/code>\uff0c\u82e5\u74b0\u5883\u652f\u63f4 bcrypt\uff0c\u5247\u4f7f\u7528 bcrypt \u7684\u6a21\u7d44\u5316\u5bc6\u78bc\u683c\u5f0f\uff08Modular Crypt Format\uff09\u3002<\/p>\n\n\n\n<p><strong>\u7d50\u69cb<\/strong>\uff08\u4ee5 WordPress \u7684 MD5 \u6a21\u5f0f\u70ba\u4f8b\uff09\uff1a<br><code>$P$B&lt;salt&gt;&lt;hash&gt;<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>$P$<\/code>\uff1a\u8868\u793a\u4f7f\u7528 phpass \u6846\u67b6\u3002<\/li>\n\n\n\n<li><code>$B<\/code>\uff1a\u8868\u793a\u57fa\u65bc MD5 \u6f14\u7b97\u6cd5\uff0c\u9810\u8a2d\u9032\u884c 8192 \u6b21\u8fed\u4ee3\u3002<\/li>\n\n\n\n<li><code>&lt;salt><\/code>\uff1a8 \u5b57\u5143\u96a8\u6a5f\u9e7d\u503c\uff08Base64 \u7de8\u78bc\uff0c\u4f7f\u7528 .\/A-Za-z0-9 \u5b57\u7b26\u96c6\uff09\u3002<\/li>\n\n\n\n<li><code>&lt;hash><\/code>\uff1a22 \u5b57\u5143\u96dc\u6e4a\u503c\uff0c\u5305\u542b\u5bc6\u78bc\u8207\u9e7d\u503c\u7684\u8a08\u7b97\u7d50\u679c\u3002<\/li>\n<\/ul>\n\n\n\n<p><strong>\u7bc4\u4f8b<\/strong>\uff1a<br><code>$P$Bsalt1234567890abcdef1234567890a<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u6f14\u7b97\u6cd5\uff1aphpass\uff08\u57fa\u65bc MD5\uff09\u3002<\/li>\n\n\n\n<li>\u8fed\u4ee3\u6b21\u6578\uff1a8192 \u6b21\uff08\u56fa\u5b9a\uff09\u3002<\/li>\n\n\n\n<li>\u9e7d\u503c\uff1a<code>salt1234<\/code>\uff088 \u5b57\u5143\uff09\u3002<\/li>\n\n\n\n<li>\u96dc\u6e4a\u503c\uff1a<code>567890abcdef1234567890a<\/code>\uff0822 \u5b57\u5143\uff09\u3002<\/li>\n<\/ul>\n\n\n\n<p><strong>bcrypt \u6a21\u5f0f\uff08\u82e5\u74b0\u5883\u652f\u63f4\uff09<\/strong>\uff1a<br>\u82e5\u4f3a\u670d\u5668\u652f\u63f4 bcrypt\uff0cphpass \u6703\u751f\u6210 bcrypt \u683c\u5f0f\u7684\u96dc\u6e4a\uff0c\u7d50\u69cb\u53c3\u8003\u4e0a\u8ff0 bcrypt\u8aaa\u660e<\/p>\n\n\n\n<p><strong>\u512a\u7f3a\u9ede<\/strong>\uff1a<br><strong>\u512a\u9ede<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7c21\u55ae\u6613\u7528\uff0c\u63d0\u4f9b\u76f4\u89c0\u7684 PHP API\uff0c\u7121\u9700\u984d\u5916\u4f9d\u8cf4\u3002<\/li>\n\n\n\n<li>\u652f\u63f4\u591a\u7a2e\u6f14\u7b97\u6cd5\uff08MD5 \u6216 bcrypt\uff09\uff0c\u5177\u5099\u74b0\u5883\u9069\u61c9\u6027\u3002<\/li>\n\n\n\n<li>\u9ad8\u8fed\u4ee3\u6b21\u6578\uff08MD5 \u6a21\u5f0f\u9810\u8a2d 8192 \u6b21\uff09\u548c\u96a8\u6a5f\u9e7d\u503c\u6709\u6548\u9632\u6b62\u5f69\u8679\u8868\u653b\u64ca\u3002<\/li>\n\n\n\n<li>\u9ad8\u5ea6\u76f8\u5bb9\uff0c\u9069\u7528\u65bc\u820a\u7248\u548c\u65b0\u7248 PHP \u74b0\u5883\u3002<\/li>\n<\/ul>\n\n\n\n<p><strong>\u7f3a\u9ede<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u9810\u8a2d MD5 \u6f14\u7b97\u6cd5\u8f03\u8001\u820a\uff0c\u73fe\u4ee3\u786c\u9ad4\u4e0b\u6297\u66b4\u529b\u7834\u89e3\u80fd\u529b\u4e0d\u5982 bcrypt \u6216 Argon2\u3002<\/li>\n\n\n\n<li>\u8fed\u4ee3\u6b21\u6578\u56fa\u5b9a\uff088192 \u6b21\uff0cMD5 \u6a21\u5f0f\uff09\uff0c\u7121\u6cd5\u50cf bcrypt \u52d5\u614b\u8abf\u6574\u6210\u672c\u56e0\u5b50\u3002<\/li>\n\n\n\n<li>\u672a\u5167\u5efa\u652f\u63f4\u73fe\u4ee3\u6f14\u7b97\u6cd5\uff08\u5982 Argon2\uff09\uff0c\u5728\u9ad8\u5b89\u5168\u6027\u5834\u666f\u4e0b\u7565\u986f\u4e0d\u8db3\u3002<\/li>\n<\/ul>\n\n\n\n<p><strong>\u5de5\u5177<\/strong>\uff1a<\/p>\n\n\n\n<p>hashcat\uff1aphpass \u7684 MD5 \u6a21\u5f0f\u5c0d\u61c9 hashcat \u7684 -m 400\uff0c\u800c bcrypt \u6a21\u5f0f\u5c0d\u61c9 -m 3200<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">md5($pass.$salt)<\/h2>\n\n\n\n<p>\u9019\u7a2e\u683c\u5f0f\u5e38\u898b\u65bc\u65e9\u671f\u5167\u5bb9\u7ba1\u7406\u7cfb\u7d71\uff08\u5982 Joomla 1.x\uff09\u6216\u81ea\u5b9a\u7fa9\u61c9\u7528\u4e2d<\/p>\n\n\n\n<p><strong>\u7d50\u69cb<\/strong>\uff1aMD5(password + salt):salt<\/p>\n\n\n\n<p><strong>\u7bc4\u4f8b<\/strong>\uff1a23859aaca71e43048d19e39d4cfd91f4:0FVBITlx9gfL7xCs07bKagEaTFnvv3LN<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>23859aaca71e43048d19e39d4cfd91f4 \u662f md5($pass.$salt) \u7684\u7d50\u679c<\/li>\n\n\n\n<li>0FVBITlx9gfL7xCs07bKagEaTFnvv3LN \u662f\u9e7d\u503c\u3002<\/li>\n<\/ul>\n\n\n\n<p><strong>\u5de5\u5177<\/strong>\uff1ahashcat -m 10<\/p>\n\n\n\n<p><strong>\u5176\u4ed6\u88dc\u5145<\/strong>\uff1a\u5176\u4ed6salt\u7d44\u5408\u7684\u9084\u6709md5($salt.$pass), md5(utf16le($pass).$salt), md5($salt.utf16le($pass)) \u7b49<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5c08\u70ba\u5bc6\u78bc\u5132\u5b58\u548c\u91d1\u9470\u884d\u751f\u7684\u5bc6\u78bc\u96dc\u6e4a\u51fd\u6578\uff0c\u5305\u62ec Bcrypt\u3001PBKDF2\u3001Scrypt \u548c Argon2\uff0c\u5404\u5177\u7279\u8272\u3002Bcrypt \u65e9\u671f\u8a2d\u8a08\uff0c\u7a69\u5b9a\u4f46\u6297\u786c\u9ad4\u653b\u64ca\u6709\u9650\uff1bPBKDF2 \u6a19\u6e96\u5316\uff0c\u9010\u6f38\u88ab Argon2 \u53d6\u4ee3\uff1bScrypt \u8a18\u61b6\u9ad4\u5bc6\u96c6\uff0c\u6297\u786c\u9ad4\u653b\u64ca\u5f37\uff1bArgon2 \u6700\u65b0\uff0c\u5b89\u5168\u6027\u6700\u9ad8\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"enabled":false},"version":2}},"categories":[375],"tags":[],"class_list":["post-2447","post","type-post","status-publish","format-standard","hentry","category-cryptographic-fundamentals"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/2447","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=2447"}],"version-history":[{"count":4,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/2447\/revisions"}],"predecessor-version":[{"id":2504,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/2447\/revisions\/2504"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=2447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=2447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=2447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}