php - 从 MySQL 获取密码哈希

Question

我正在 PHP 中生成密码，如下所示:

$options = [
    'cost' => 11,
];
// Get the password from post
$passwordFromPost = $_POST['password'];

$hash = password_hash($passwordFromPost, PASSWORD_BCRYPT, $options);

然后我将其插入 MySQL 表中。

现在，我想取回它。我使用的是哈希+盐密码，但我想删除盐选项。如何在 PHP 中检索创建的密码？

Answer 1

好的，就这样吧。您无法再次检索原始密码，因为散列(散列+盐)是一种单向加密技术(这是有道理的，人们不应该能够读取任何人的原始密码并滥用)。它的工作方式是，当用户输入密码进行登录时，将遵循相同的加密算法(在存储时遵循)来创建哈希值。现在，散列与散列之间进行比较，以获得有效的 session token 。

Now, coming to the question if you want to change the encryption algorithm or the salt, you need to allow user to login with the old encryption algo. What you should be doing is to gradual migration of old user's password hash to new password hash. And the only option you get the raw pass is when user type them in. You need to identify if they are the old users, if they are allow them log-in with backward compatible algorithm and silently update their password with encrypted with the new salt.