PHP Crypt() 与 Python 的 Crypt() 哈希对比

Question

我正在比较 PHP 的 crypt() 与 Python 的 crypt()。来自阅读 Python 手册:

http://docs.python.org/2/library/crypt.html

Platforms: Unix

This module implements an interface to the crypt(3) routine, which is a one-way hash function based upon a modified DES algorithm; see the Unix man page for further details. Possible uses include allowing Python scripts to accept typed passwords from the user, or attempting to crack Unix passwords with a dictionary.

Notice that the behavior of this module depends on the actual implementation of the crypt(3) routine in the running system. Therefore, any extensions available on the current implementation will also be available on this module.

crypt.crypt(word, salt) word will usually be a user’s password as typed at a prompt or in a graphical interface. salt is usually a random two-character string which will be used to perturb the DES algorithm in one of 4096 ways. The characters in salt must be in the set [./a-zA-Z0-9]. Returns the hashed password as a string, which will be composed of characters from the same alphabet as the salt (the first two characters represent the salt itself).

通过阅读 PHP 的地穴:

http://php.net/manual/en/function.crypt.php

CRYPT_SHA512 - SHA-512 hash with a sixteen character salt prefixed with $6$. If the salt string starts with 'rounds=$', the numeric value of N is used to indicate how many times the hashing loop should be executed, much like the cost parameter on Blowfish. The default number of rounds is 5000, there is a minimum of 1000 and a maximum of 999,999,999. Any selection of N outside this range will be truncated to the nearest limit.

公平地说，我不包括 Python 的第三方模块...我想比较 PHP crypt() 和 Python crypt() 两种股票。

在阅读了这两个并进行比较之后......它看起来像使用 SHA512 的 PHP Crypt() 并且它的最大 999,999,999 轮哈希比 Python 的 Crypt() 强大/优越。这个确认了吗？或者我没有正确阅读这个。

Answer 1

请注意，Python crypto 只是 crypt (3) 调用的包装器，您提到的文档指的是基本 POSIX 版本，可在任何地方使用。 crypto 的大多数实现都在此基础上进一步扩展，如文档所述:

Notice that the behavior of this module depends on the actual implementation of the crypt(3) routine in the running system. Therefore, any extensions available on the current implementation will also be available on this module.

如果您查看 glibc version (这是绝大多数 Linux 系统使用的)，你会发现 PHP 文档列出的所有算法都已实现。另外，看看 the source code of one crypt module查看是否支持迭代(回合)参数。

您问题中的 PHP 文档列出了所有算法，因此作者理所当然地认为它将安装在具有最新 glibc 的系统上，或者他们设法在所有系统上模拟缺失的算法。