blocks|key|1210899|text|MD5+(Message-Digest+algorithm+5)是一种加密哈希函数，而Advanced+Encryption+Standard+(AES)是一种对称密钥加密算法，因此它们用于不同的目的。像MD5或SHA这样的散列用于验证密码，因为它很难反转，也就是从散列字符串中获取密码。另一方面，AES加密是可逆的，如果您知道密钥，则可以获得原始消息。因此，如果多个消息使用相同的密钥加密，知道它会暴露所有消息，而如果您设法找到散列的原始字符串(彩虹表等)，则您只发现了该特定实例的纯文本，并且您必须重做此工作以找到另一个散列字符串的解决方案。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1210900|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/MD5|1|http://en.wikipedia.org/wiki/Advanced_Encryption_Standard^0|0|W|0|17|Y|1|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]|$A|R|B|S|1|T]]|C|$]]|$1|D|3|-4|5|6|7|U|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]]]

<a href="http://en.wikipedia.org/wiki/MD5" rel="nofollow noreferrer">MD5 (Message-Digest algorithm 5)</a> is a cryptographic hash function, while <a href="http://en.wikipedia.org/wiki/Advanced_Encryption_Standard" rel="nofollow noreferrer">Advanced Encryption Standard (AES)</a> is a symmetric-key encryption algorithm, so they are used for different purposes. A hash, like MD5 or SHA is used to verify passwords because it's hard to invert, that is, to obtain the password from the hash-string. An AES encryption, on the other hand, is invertible, the original message can be obtained if you know the key. So, if multiple messages are encrypted with the same key, knowing it exposes all of them, whereas if you manage to find a hash's original string(rainbow tables, etc), you've only discovered the plain text for that particular instance, and you'll have to redo the work to find a sollution for another hash-string.

blocks|key|1210969|text|因为AES加密是对称的。给定一个使用AES加密的密码和密钥，您可以解密该密码。这是不可取的，因为您几乎总是希望只有密码的所有者知道它，而不希望有一种简单的方法来派生密码。另一方面，SHA和MD5算法(主要)执行密码的单向转换。没有一段信息(密钥)允许您将转换后的密码返回到其明文形式。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1210970|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Because AES encryption is symmetric. Given a password encrypted with AES and the key, you can decrypt the password. This is undesirable, because you almost always want only the owner of the password to know it and don't want to have an easy way to derive the password. The SHA and MD5 algorithms, on the other hand, perform a (mostly) one-way transformation of the password. There is no piece of information (key) that allows you to return the transformed password back to its plaintext form.

blocks|key|996727|text|使用AES作为密码的对称密码将是CWE-257的一种版本，因此存在漏洞。可以使用symmetric+cipher+as+a+hash+function。旧的unix密码使用DES作为散列函数，较新的unix系统使用blowfish作为散列函数。但是，尽管它是一个分组密码，但它被用作单向函数，这是任何密码存储系统的要求。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|996728|对于php，你应该使用sha256。|996729|entityMap|0|LINK|mutability|MUTABLE|url|http://cwe.mitre.org/data/definitions/257.html|1|http://en.wikipedia.org/wiki/Cryptographic_hash_function#Hash_functions_based_on_block_ciphers|2|http://www.nanolink.ca/pub/sha256/sha256.inc.txt^0|G|7|0|14|Z|1|0|B|6|2|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]|$A|V|B|W|1|X]]|C|$]]|$1|D|3|E|5|6|7|Y|8|@]|9|@$A|Z|B|10|1|11]]|C|$]]|$1|F|3|-4|5|6|7|12|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]|P|$5|I|J|K|C|$L|Q]]]]

The use of AES as a symmetric cipher for passwords would be a volation of <a href="http://cwe.mitre.org/data/definitions/257.html" rel="nofollow noreferrer">CWE-257</a> and there for a vulnerability. It is possible to use a <a href="http://en.wikipedia.org/wiki/Cryptographic_hash_function#Hash_functions_based_on_block_ciphers" rel="nofollow noreferrer">symmetric cipher as a hash function</a>. Old unix passwords use DES as a hash function and newer unix systems use blowfish as a hash function. But even though its a block cipher, its being used as a one-way function, which is a requirement for any password storage system. 

For php you should use <a href="http://www.nanolink.ca/pub/sha256/sha256.inc.txt" rel="nofollow noreferrer">sha256</a>.

blocks|key|996791|text|简而言之:+AES是可逆的。散列函数不是。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|996792|作为对被接受的答案的回应...(对不起，我是新用户，还不能发表评论...)加盐只会阻止基于彩虹表的攻击。它不保护“弱密码”。要保护较弱的密码，您需要使用已被证明速度较慢的散列函数。正确配置的bcrypt是完成此操作的最简单方法。MD5和SHA1速度太快，不安全。(与MD5发现的冲突与我描述的这个问题无关)|996793|所有使用MD5或SHA1加密的8字符密码(即使正确加盐)都可以被this+dude+in+a+single+day破解。加盐并不能防止这种攻击。“优化”攻击，使其只包含英语中的~500k个单词...它们的10,000个最常见的变体将破解大量的密码。|offset|length|996794|BCrypt对这类攻击的抵抗力更强，因为它(可以配置为)比MD5慢数百万倍。从理论上讲，反复使用MD5一百万次也能达到同样的效果，但我建议您坚持使用经过良好测试的库，而不是使用自己的实现。当然，BCrypt也使用Salting，并且在大多数编程语言中都可用。所以没有理由不使用它。|996795|从理论上讲，SCrypt更好，但它太新了(因此，实现可能仍然有一点but+)|996796|长话短说：SHA512+vs.+Blowfish+and+Bcrypt|996797|entityMap|0|LINK|mutability|MUTABLE|url|http://nsa.unaligned.org/index.php|1|https://stackoverflow.com/questions/1561174/sha512-vs-blowfish-and-bcrypt^0|0|0|W|P|0|0|0|0|5|U|1|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Y|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Z|8|@]|9|@$F|10|G|11|1|12]]|A|$]]|$1|H|3|I|5|6|7|13|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|14|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|15|8|@]|9|@$F|16|G|17|1|18]]|A|$]]|$1|N|3|-4|5|6|7|19|8|@]|9|@]|A|$]]]|O|$P|$5|Q|R|S|A|$T|U]]|V|$5|Q|R|S|A|$T|W]]]]

In short: AES is reversable. A hash function is not.

In response to the accepted answer... (sorry, I'm a new user, can't post comments yet...) Salting only prevents Rainbow Table based attacks. It does not protect "weak passwords". To protect the weaker passwords, you will need to use a hash function that has been proven to be slow. A properly configured bcrypt is the easiest way to do this. MD5 and SHA1 are too fast to be secure. (The collisions found with MD5 are unrelated to this problem I'm describing)

All 8-character passwords encrypted with MD5 or SHA1 (even when properly salted) can be cracked by <a href="http://nsa.unaligned.org/index.php" rel="nofollow noreferrer">this dude in a single day</a>. Salting does NOT prevent this kind of attack. "Optimizing" the attack to consist of only the ~500k words in the english language... and the 10,000 most common variations of them will crack a huge number of passwords.

BCrypt is stronger against this kind of attack because it (can be configured to be) millions of times slower than MD5. Iteratively using MD5 a million times will theoretically achieve the same thing, but I suggest you stick with well tested libraries instead of rolling your own implementation. BCrypt uses Salting as well of course, and is available in most programming languages. So no reason to NOT use it.

In theory, SCrypt is better, but its too new (and therefore, implementations are probably still a little buggy)

Long story short: <a href="https://stackoverflow.com/questions/1561174/sha512-vs-blowfish-and-bcrypt">SHA512 vs. Blowfish and Bcrypt</a>

Everywhere I have seen people talking about storing passwords in a database, they have almost always used MD5.

What is wrong with AES, or SHA1?

Why not use AES for password encryption in PHP?

哈希函数

数据库

无论我在哪里看到人们谈论在数据库中存储密码，他们几乎总是使用MD5。AES或SHA1有什么问题？

问为什么不在PHP中使用AES进行密码加密？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问为什么不在PHP中使用AES进行密码加密？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问为什么不在PHP中使用AES进行密码加密？
EN