password-encryption | 易学教程

AES-256 Password Based Encryption/Decryption in Java

阅读更多关于 AES-256 Password Based Encryption/Decryption in Java

问题 I found a guide for implementing AES encryption/decryption in Java and tried to understand each line as I put it into my own solution. However, I don't fully understand it and am having issues as a result. The end goal is to have passphrase based encryption/decryption. I've read other articles/stackoverflow posts about this, but most do not provide enough explanation (I am very new to crypto in Java) My main issues right now are that even when I set byte[] saltBytes = "Hello".getBytes(); I

Call to undefined function password_hash() [closed]

阅读更多关于 Call to undefined function password_hash() [closed]

问题 I am running php version 5.4.16 on localhost right now, while I am developing my site. I want to use password_hash() , but I keep getting this error: Fatal error: Call to undefined function password_hash() in /dir/to/file.php on line 123 Why is this happening? Thanks! 回答1: The new password_* methods are only available as of PHP 5.5: http://www.php.net/manual/en/function.password-hash.php Take a look at this library that provides forward compatibility: https://github.com/ircmaxell/password

bcrypt and randomly generated salts

阅读更多关于 bcrypt and randomly generated salts

So I was experimenting with bcrypt. I have a class(shown below, which I got from http://www.firedartstudios.com/articles/read/php-security-how-to-safely-store-your-passwords ) in which there are 3 functions. 1st one is to generate a random Salt, the 2nd to generate a hash using the 1st generated Salt and the last one is to verify the supplied password by comparing it with the hashed password. <?php /* Bcrypt Example */ class bcrypt { private $rounds; public function __construct($rounds = 12) { if(CRYPT_BLOWFISH != 1) { throw new Exception("Bcrypt is not supported on this server, please see the

Password to key function compatible with OpenSSL commands?

阅读更多关于 Password to key function compatible with OpenSSL commands?

For example, the command: openssl enc -aes-256-cbc -a -in test.txt -k pinkrhino -nosalt -p -out openssl_output.txt outputs something like: key = 33D890D33F91D52FC9B405A0DDA65336C3C4B557A3D79FE69AB674BE82C5C3D2 iv = 677C95C475C0E057B739750748608A49 How is that key generated? (C code as an answer would be too awesome to ask for :) ) Also, how is the iv generated? Looks like some kind of hex to me. indiv OpenSSL uses the function EVP_BytesToKey . You can find the call to it in apps/enc.c . The enc utility used to use the MD5 digest by default in the Key Derivation Algorithm (KDF) if you didn't

bcrypt and randomly generated salts

阅读更多关于 bcrypt and randomly generated salts

问题 So I was experimenting with bcrypt. I have a class(shown below, which I got from http://www.firedartstudios.com/articles/read/php-security-how-to-safely-store-your-passwords) in which there are 3 functions. 1st one is to generate a random Salt, the 2nd to generate a hash using the 1st generated Salt and the last one is to verify the supplied password by comparing it with the hashed password. <?php /* Bcrypt Example */ class bcrypt { private $rounds; public function __construct($rounds = 12) {

Where to put password_verify in login script?

阅读更多关于 Where to put password_verify in login script?

问题 Another night, another question! I have created a log in page which works fine if the passwords are in plain text. The issue I have is that my sign up form uses password_hash to enter an encrypted password to the table. My current scripts are below. Sign Up Script $password = password_hash($_POST[\'password\'], PASSWORD_DEFAULT); Log In Script <?php session_start(); if(isset($_POST[\'email\'], $_POST[\'password\'])){ require(\'../../../private_html/db_connection/connection.php\'); $conn = new

How should I ethically approach user password storage for later plaintext retrieval?

阅读更多关于 How should I ethically approach user password storage for later plaintext retrieval?

问题 As I continue to build more and more websites and web applications I am often asked to store user\'s passwords in a way that they can be retrieved if/when the user has an issue (either to email a forgotten password link, walk them through over the phone, etc.) When I can I fight bitterly against this practice and I do a lot of ‘extra’ programming to make password resets and administrative assistance possible without storing their actual password. When I can’t fight it (or can’t win) then I

Where to put password_verify in login script?

阅读更多关于 Where to put password_verify in login script?

Another night, another question! I have created a log in page which works fine if the passwords are in plain text. The issue I have is that my sign up form uses password_hash to enter an encrypted password to the table. My current scripts are below. Sign Up Script $password = password_hash($_POST['password'], PASSWORD_DEFAULT); Log In Script <?php session_start(); if(isset($_POST['email'], $_POST['password'])){ require('../../../private_html/db_connection/connection.php'); $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password); $conn->setAttribute(PDO::ATTR_ERRMODE, PDO