密碼加鹽加密與存儲使用

 

為防止密碼泄露與輕易被暴力破解，采用hash等方式已經不再安全，可以采用如彩虹橋類似方式進行破解，

推薦采用加鹽的方式對密碼進行加密機存儲

package test;

import java.security.MessageDigest;
import java.util.UUID;

/**
 * 加密
 * 
 * @author xiaochangwei
 *
 */
public class PasswordEncryptor {

    private final static String[] hexDigits = { "0", "1", "2", "3", "4", "5",
            "6", "!", "#", "@", "a", "b", "c", "d", "*", "f", "g", "F" };

    private Object salt;
    private String algorithm;

    public PasswordEncryptor(Object salt, String algorithm) {
        this.salt = salt;
        this.algorithm = algorithm;
    }

    public String encode(String rawPass) {
        String result = null;
        try {
            MessageDigest md = MessageDigest.getInstance(algorithm);
            // 加密后的字符串
            result = byteArrayToHexString(md.digest(mergePasswordAndSalt(
                    rawPass).getBytes("utf-8")));
        } catch (Exception ex) {
        }
        return result;
    }

    public boolean isPasswordValid(String encPass, String rawPass) {
        String pass1 = "" + encPass;
        String pass2 = encode(rawPass);

        return pass1.equals(pass2);
    }

    private String mergePasswordAndSalt(String password) {
        if (password == null) {
            password = "";
        }

        if ((salt == null) || "".equals(salt)) {
            return password;
        } else {
            return password + "{" + salt.toString() + "}";
        }
    }

    /**
     * 轉換字節數組為16進制字串
     * 
     * @param b
     *            字節數組
     * @return 16進制字串
     */
    private static String byteArrayToHexString(byte[] b) {
        StringBuffer resultSb = new StringBuffer();
        for (int i = 0; i < b.length; i++) {
            resultSb.append(byteToHexString(b[i]));
        }
        return resultSb.toString();
    }

    private static String byteToHexString(byte b) {
        int n = b;
        if (n < 0)
            n = 256 + n;
        int d1 = n / hexDigits.length;
        int d2 = n % hexDigits.length;
        return hexDigits[d1] + hexDigits[d2];
    }

    public static void main(String[] args) {
        String salt = UUID.randomUUID().toString();
        PasswordEncryptor encoderMd5 = new PasswordEncryptor(salt, "sha-256");
        String encodedPassword = encoderMd5.encode("xiaochangwei's password");
        System.out.println("加密后密碼：" + encodedPassword + "\n密碼長度：" + encodedPassword.length());
        System.out.println("salt:" + salt);
    }

}

運行結果如下：

加密后密碼：3@12@g2a0bdgb16044@fdf5c0*d1!d625abc403*46b1a!c@a6@62F#!42cc662f
密碼長度：64
salt:dc853799-fd09-48ed-b5c0-4b323cd39b53

 

在數據庫中存儲時，需要將salt和加密后的密碼都進行存儲。

 

在進行使用時，根據用戶名查詢出用戶的鹽 與輸入的密碼進行運算， 如果運算結果和數據庫中存儲的密碼一致，則合法

效率上也只需要一次查詢，不存在性能問題