多少盐安全是太多盐安全

Question

    Public Function EncryptPassword(Password As String) As String

        Dim EPassword As String = String.Empty

        ' Generate Random 128 Base64 Salt String
        Dim Salt As String = Var.Simple3Des.GenerateSalt

        ' Divide into Substrings, and combine into splitable string
        Dim SmallSalts As String = Salt.Substring(0, 32) + "." + Salt.Substring(32, 32) + "." + Salt.Substring(64, 32) + "." + Salt.Substring(96, 32)

        ' Create the Salt Array
        Dim SaltArray = Split(SmallSalts, ".")

        ' Randomly Choose part of the array to actually use as salt
        Dim rnd As New Random
        Dim TrueSalt As String = SaltArray(rnd.Next(0, SaltArray.Length))

        ' Encrypt The Password
        Dim Security As New Var.Simple3Des(TrueSalt)
        EPassword = Security.EncryptData(Password)

        ' Divide up the salt and password and place into same string
        Dim PasswordString As String = Salt.Substring(0, 16) + EPassword.Substring(0, 6) + Salt.Substring(16, 112) + EPassword.Substring(6, EPassword.Length - 6)

        Return PasswordString

    End Function

然后我使用相同的公式来解密密码，通过尝试所有可能的子字符串组合，直到找到正确的一个。

 Public Function DecryptPassword(NtID As String)

            ' Grab The Users Encrypted Password
            Dim UserID As Integer = GetAppUserID(NtID)
            Dim User As Users = Var.db.Web.Users.Find(UserID)
            Dim EPassword = User.Password

            ' Divided the Encrypted Password Into Salt and Actual Password
            Dim Salt As String = EPassword.Substring(0, 16) + EPassword.Substring(22, 112)
            Dim Password As String = EPassword.Substring(16, 6) + EPassword.Substring(134, EPassword.Length - 134)
            Dim DPassword As String = String.Empty

            ' Try each substring of Salt until password is Decrypted.
            Try
                If DPassword = String.Empty Then
                    Dim Security As New Var.Simple3Des(Salt.Substring(0, 32))
                    DPassword = Security.DecryptData(Password)
                End If
            Catch ex As Exception
                DPassword = String.Empty
            End Try

            Try
                If DPassword = String.Empty Then
                    Dim Security As New Var.Simple3Des(Salt.Substring(32, 32))
                    DPassword = Security.DecryptData(Password)
                End If
            Catch ex As Exception
                DPassword = String.Empty
            End Try

            Try
                If DPassword = String.Empty Then
                    Dim Security As New Var.Simple3Des(Salt.Substring(64, 32))
                    DPassword = Security.DecryptData(Password)
                End If
            Catch ex As Exception
                DPassword = String.Empty
            End Try

            Try
                If DPassword = String.Empty Then
                    Dim Security As New Var.Simple3Des(Salt.Substring(96, 32))
                    DPassword = Security.DecryptData(Password)
                End If
            Catch ex As Exception
                DPassword = String.Empty
            End Try

            Return DPassword
        End Function

我的问题是A.除了可能的性能问题之外，这种方法还会带来什么危险？
B.这种方法是否矫枉过正，像这样加盐和存储盐/密码有必要吗？c.如果没有必要，我还可以使用什么其他方法来加盐和存储盐/密码？

Answer 1

这里有一个很好的站点，可以讨论您感兴趣的东西：https://crackstation.net/hashing-security.htm。他们所说的总的观点是：

1. 如果您自己不小心，干扰精心编制的安全算法实际上会降低其安全性。
2. 这是矫枉过正的，因为您必须假设攻击者在破解数据库之前会获得您的代码，这样他们就会知道您的方案。
3. 简单地存储散列和盐就可以了。这就是散列和盐的要点。

我经常使用crackstation页面作为散列安全性的一般参考。我强烈建议阅读它，因为它可能包含大量的信息，你会发现相关的，而我在这里省略了。