0
我从http://msftdbprodsamples.codeplex.com/releases/view/55330得到了AdventureWorks2012 DB,并尝试从Person.Password表中验证密码。 'PasswordHash'列描述为“电子邮件帐户的密码”。和'PasswordSalt'列描述说:“在密码被散列之前,随机值与密码字符串连接”。AdventureWorks2012 DB - 如何存储密码以及验证密码的方式?
下面是从数据库中的样本数据:
BusinessEntityID, PasswordHash, PasswordSalt, EmailAddress
---------------- --------------------------------------------------------------------------
1, pbFwXWE99vobT6g+vPWFy93NtUU/orrIWafF01hccfM=, bE3XiWw=, [email protected]
2, bawRVNrZQYQ05qF05Gz6VLilnviZmrqBReTTAGAudm0=, "EjJaC3U=, [email protected]
我怎么知道哪个散列算法被用来创建PasswordHash?以及如何生成passwordsalt?
下面是代码尝试验证密码,但没有任何散列算法正在工作。任何人都可以请解释一下这个?
public class SecurityService : ISecurityService
{
public string UserName { get; set; }
public bool ValidateCredentials(string password, Password dbPassword)
{
bool valid = false;
byte[] saltBytes = Convert.FromBase64String(dbPassword.PasswordSalt); //dbPassword.PasswordSalt: bE3XiWw=
byte[] passwordBytes = Encoding.Unicode.GetBytes(password); //password: [email protected]
byte[] passwordHashBytes = Convert.FromBase64String(dbPassword.PasswordHash);//dbPassword.PasswordHash: pbFwXWE99vobT6g+vPWFy93NtUU/orrIWafF01hccfM=
byte[] passwordHashed = Hash(passwordBytes, saltBytes);
byte[] dbPasswordHashed = Hash(passwordHashBytes, saltBytes);
valid = dbPasswordHashed.SequenceEqual(passwordHashed);
return valid;
}
private static byte[] Hash(byte[] value, byte[] salt)
{
byte[] saltedValue = value.Concat(salt).ToArray();
return HashAlgorithm.Create("MD5").ComputeHash(saltedValue);
//return HashAlgorithm.Create("SHA1").ComputeHash(saltedValue);
//return HashAlgorithm.Create("SHA256").ComputeHash(saltedValue);
//return HashAlgorithm.Create("SHA384").ComputeHash(saltedValue);
//return HashAlgorithm.Create("SHA512").ComputeHash(saltedValue);
}
}
你确定在这个例子中来自电子邮件地址栏的密码和值是相同的吗? –
是的,这是passwordhash列的描述。 – user3851226