passwords - bcrypt——跟上摩尔定律

Question

这个问题在这里已经有了答案:





Optimal bcrypt work factor

(3 个回答)


5年前关闭。




我正在使用 bcrypt将密码存储在我的数据库中，使用 7 的工作系数，在我相当现代的笔记本电脑上散列一个密码大约需要 0.02 秒。

Coda Hale 说，使用 bcrypt 可以通过调整工作系数来“跟上摩尔定律”。但是没有办法重新加密用户的密码，因为我没有存储明文。我怎样才能使我的数据库保持最新且难以破解(假设它存在 5 年以上，这将成为一个问题)？

Answer 1

登录时重新加密。见 Optimal bcrypt work factor .

Remember that the value is stored in the password: $2a$(2 chars work)$(22 chars salt)(31 chars hash). It is not a fixed value.

If you find the load is too high, just make it so the next time they log in, you crypt to something faster to compute. Similarly, as time goes on and you get better servers, if load isn't an issue, you can upgrade the strength of their hash when they log in.

The trick is to keep it taking roughly the same amount of time forever into the future along with Moore's Law. The number is log2, so every time computers double in speed, add 1 to the default number...