gpt4 book ai didi

java - 如何在 Java 中使用 BouncyCaSTLe API 对密码进行加密和加盐?

转载 作者:行者123 更新时间:2023-12-03 00:25:04 24 4
gpt4 key购买 nike

我对加密相当陌生,我正在使用BouncyCasetle API加密密码并将其存储在数据库中。对于加密,我使用SHA-1算法,并且我想对密码加盐以防止字典攻击。

如有任何帮助,我们将不胜感激。

最佳答案

我建议使用基于密码的 key 派生函数而不是基本的哈希函数。像这样的事情:

// tuning parameters

// these sizes are relatively arbitrary
int seedBytes = 20;
int hashBytes = 20;

// increase iterations as high as your performance can tolerate
// since this increases computational cost of password guessing
// which should help security
int iterations = 1000;

// to save a new password:

SecureRandom rng = new SecureRandom();
byte[] salt = rng.generateSeed(seedBytes);

Pkcs5S2ParametersGenerator kdf = new Pkcs5S2ParametersGenerator();
kdf.init(passwordToSave.getBytes("UTF-8"), salt, iterations);

byte[] hash =
((KeyParameter) kdf.generateDerivedMacParameters(8*hashBytes)).getKey();

// now save salt and hash

// to check a password, given the known previous salt and hash:

kdf = new Pkcs5S2ParametersGenerator();
kdf.init(passwordToCheck.getBytes("UTF-8"), salt, iterations);

byte[] hashToCheck =
((KeyParameter) kdf.generateDerivedMacParameters(8*hashBytes)).getKey();

// if the bytes of hashToCheck don't match the bytes of hash
// that means the password is invalid

关于java - 如何在 Java 中使用 BouncyCaSTLe API 对密码进行加密和加盐?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/21565369/

24 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com