Principle of password and salt

It turns out that this technology is called salt, which we often use in the past.

========================================================== ========================================================== ====

We know that if the password is hashed directly, hackers can obtain the hash value of the password, and then query the hash value Dictionary (for example, MD5 password cracking website ), obtain the password of a user.

Add salt can solve this problem to some extent. The so-called add salt method is to add some "condiments ". The basic idea is as follows: when a user provides a password for the first time (usually during registration), the system automatically adds "condiments" to the password and then hashes it. When a user logs on, the Code provided by the system for the user is sprinkled with the same "seasoning", and then hash, and then compare the hash value. It is determined that the password is correct. The "seasoning" here is called the "salt value", which is randomly generated by the system and only known by the system. In this way, even if two users use the same password, their hash values are different because the system generates different salt values for them. Even if hackers can use their own passwords and their own hash values to find users with specific passwords, the probability is too small (the passwords and salt values must be the same as those used by hackers ). The following example uses PHP to illustrate the MD5 ($ pass. $ salt) encryption function. <? Phpfunction Hash ($ A) {$ salt = "random_kugbjvy"; // defines a salt value, a random string specified by the programmer $ B = $. $ salt; // connect the password to salt $ B = MD5 ($ B); // execute the MD5 hash return $ B; // return the hash}?> Call method: $ new_password = hash ($ _ post [Password]); // here, accept the form submission value and encrypt it. The following describes the process of adding a salt hash. I would like to emphasize one point before the introduction. As mentioned above, the "same" seasoning should be used when the password is verified and the original hash password is used. Therefore, the salt value is stored in the database. When a user registers, the user enters the [account] and [Password] (and other user information), and the system generates the [salt value] For the user ]; the [salt value] and [User Password] are connected together. The connected values are hashed to obtain the [hash value ]; put [hash value 1] and [salt value] into the database respectively. When a user logs on, the user enters the [account] and [Password]; The system finds the corresponding [hash value] and [salt value] through the user name ]; the system connects the salt value and the password entered by the user. The connected values are hashed, get [hash value 2] (note that it is the value calculated in real time). Compare whether [hash value 1] and [hash value 2] are equal. If they are equal, the password is correct, otherwise, the password is incorrect. Sometimes, to reduce the development pressure, programmers will use a single salt value (stored somewhere) instead of generating private salt values for each user.