Salt and hashing, why not use username?

后端 未结 3 1636
南笙
南笙 2021-02-06 22:20

I must confess to being largely ignorant on most of the high-tech security issues relevant for web applications, but there is one thing I at least thought I could ask because it

3条回答
  •  自闭症患者
    2021-02-06 22:58

    How about:

    Salt = CryptoHash( CryptoHash(SubmittedEmailOrUsername) . CryptoHash(SubmittedPasswd) ) ?
    

    That would seemingly

    1. have the advantage of not needing to store the salt as it can be dynamically calculated,
    2. while still having good entropy (hash-based instead of plaintext), and

    3. provides a salt that's as long as a cryptographic hash eg 128-512 bits?

    One problem would be if the system allowed two user to have the username and password (wouldnt happen with email addr though), but are there any other problems with this scheme?

提交回复
热议问题