node.js - 复制由 bcrypt 散列的密码

Question

我使用类似的方式存储我的密码

var salt = bcrypt.genSaltSync(10);
var hash = bcrypt.hashSync('password', salt); //hash = $2a$10$MCNmLPkgiZ9jH9/0x4ZVJOvxYratODHJbcC6.X3vIDoxOfFwBYCpK

我想将我的数据库移动到另一台机器上，然后砰!我所有的密码都是错误的

如果我在新机器上执行相同的代码，我会得到不同的哈希值，这很重要吗？

var salt = bcrypt.genSaltSync(10);
var hash = bcrypt.hashSync('password', salt); //hash = $2a$10$LLi4TyJ1oP69HQMkPpsExO4hinwW3SmURR0mqmB1ranCJX3ed5oDC

Answer 1

这是设计使然。检查密码的工作流程不涉及生成新的盐，仅在检查明文是否正确时使用现有的盐。

来自wikipedia on password salts :

To understand the difference between cracking a single password and a set of them, consider a single password file that contains hundreds of usernames and passwords. Without a salt, an attacker could compute hash(attempt[0]), and then check whether that hash appears anywhere in the file. The likelihood of a match, i.e. cracking one of the passwords with that attempt, increases with the number of passwords in the file. If salts are present, then the attacker would have to compute hash(salt[a] . attempt[0]), where "." denotes concatenation, compare against entry A, then hash(salt[b] . attempt[0]), compare against entry B, and so on. This defeats "reusing" hashes in attempts to crack multiple passwords.