生成用户唯一的hmac密钥以进行密码散列

For my website's password hashing I wrote the following function:

public function hash($user) {
    $user_key = hash_hmac('sha512', $user['id'].$user['email'], $this->site_key);
    $password = hash_hmac('sha512', $user['password'], $user_key);
}

I generate user unique keys to use for the final password hashing. Because this key is hashed with sha512 it should give enough security based on what I read on wikipedia:

The cryptographic strength of the HMAC depends upon the cryptographic strength of the underlying hash function, the size of its hash output length in bits and on the size and quality of the cryptographic key.

I have not seen this way if hashing passwords before and was wondering if it is good enough?

Extra: I have not used a salt because I think hmac appends the provided key to the data (like a salt), is this right?

1个回答

OK, first and foremost. Do not write up your own function to do password hashing. I'm not doubting your skills, but to be safe do not do your own hashing system. And an HMAC your key is OK, but I'd still not use it.

Finally I'd suggest that you do this for your users passwords.

<?PHP

$password=$user['password'];
$username=$user['username'];

$salt='usesomesillystringforsalt';
$hashed_password=crypt($password.$username,'$2a$04$usesomesillstringforsalt$');

?>

This algorithm uses Bcrypt which is based upon Blowfish it is a very robust algorithm and is what Gawker media went to after they were hacked due to the robustness and usefulness for password hashing. crypt PHP Manual

Next up, remember to change the part that says usesomesillystringforsalt to something else. It needs to be 22 digits of base64 salt A-Z,a-z,0-9,/ and "."

Go to that link to find out more about the algorithm itself. I suggest that you just use this implementation as it is much much stronger than the one that you were suggesting.

If you want to go a step forward, I'd suggest that you use a unique salt for every user. If you want to do that, I can write up an example function which will show you how to do that.

As stated, if you have any more questions feel free to ask.

dougua9165
dougua9165 我做了一些研究,现在正在使用phpass
大约 9 年之前 回复
Csdn user default icon
上传中...
上传图片
插入图片
抄袭、复制答案,以达到刷声望分或其他目的的行为,在CSDN问答是严格禁止的,一经发现立刻封号。是时候展现真正的技术了!
立即提问