Many hash iterations: append salt every time?

前端 未结 5 677
野趣味
野趣味 2020-11-28 08:24

I have used unsalted md5/sha1 for long time, but as this method isn\'t really secure (and is getting even less secure as time goes by) I decided to switch to a salted sha512

5条回答
  •  Happy的楠姐
    2020-11-28 09:24

    In addition to re-hashing it multiple times, I would use a different salt for each password/user. Though I think 5000 iterations is a bit too much, try a lower number. There's a trade-off here; you'll have to tweak it according to your needs and hardware.

    With different salts for each password, an attacker would be forced to bruteforce each password individually instead of constructing a rainbow table, which increases the workload considerably.

    As always, here's a recommended read for this: Just hashing is far from enough

    EDIT: Iterative hashing is a perfectly valid tactic. There are trade-offs, but everything has them. If you are worried about computation time, why not just store the plaintext password?

提交回复
热议问题