On the principle of adding salt to the password (reprint)

Original source: http://www.2cto.com/Article/201201/117051.html

We know that if the password is hashed directly, then the hacker can get a hash value by obtaining this password, and then by checking the hash value dictionary (for example, MD5 password cracking site), the password of a user.

Adding salt can solve this problem to some extent. The so-called salt method is adding "seasoning". The basic idea is this: when the user first provides the password (usually at the time of registration), the system automatically sprinkle some "seasoning" into this password, and then hash. When the user logs in, the system provides the user with the same "seasoning" code, then hash, and then compare the hash value, determined whether the password is correct.

The "seasoning" here is called the "salt value", which is generated randomly by the system and is only known to the system. This way, even if two users use the same password, their hash values are different because the system produces a different salt value for them. Even if a hacker can find a user with a specific password by their own password and the hash value they generate, the odds are too small (passwords and salt are just as good as hackers).

The following PHP example explains the MD5 ($pass. $salt) Cryptographic functions.

<?php
function hash ($a) {
$salt = "Random_kugbjvy"; Defines a salt value, a random string that the programmer prescribes
$b = $a. $salt; Connect the password and salt
$b =md5 ($b); Perform MD5 hashing
return $b; return Hash
}
?>

Call mode: $new _password=hash ($_post[password]); The form submission value is accepted here and encrypted

The process of adding salt hashes is described in more detail below. Before the introduction, it is emphasized that the "same" seasoning is used when verifying the password and initially hashing the password. So the salt value is to be stored in the database.

When the user registers,

User input "account" and "password" (as well as other user information); The system generates a "salt value" for the user, the system connects the "salt value" and "User password", hashes the concatenated values, and puts the "hash value 1" and "salt value" into the database respectively.
When a user logs on,

User input "account" and "password", the system through the user name to find the corresponding "hash value" and "salt value"; The system connects the "salt value" and "User entered password", and hashes the concatenated values to get "hash value 2" (Note that the value is calculated immediately); Compare " The hash value 1 "and the" hash value 2 "are equal, and the equivalent means the password is correct, otherwise the password is incorrect.
Sometimes, in order to reduce development pressure, programmers use a single salt value (stored somewhere) instead of each user generating a private salt value

On the principle of adding salt to the password (reprint)