口令加密算法安全性分析与对比  

Security Analysis and Comparison of Password Encryption Algorithms

作　　者：祁鑫[1] 魏美荣[1] 蒋文保[1] 

机构地区：[1]北京信息科技大学,北京100192

出　　处：《网络空间安全》2016年第11期34-38,共5页Cyberspace Security

基　　金：国家自然科学基金资助项目[61540020]

摘　　要：随着信息技术的快速发展与渗透,数据库应用越来越广泛。但伴随着近期CSDN、如家、汉庭甚至小米论坛所涉及的数据泄露事件,也表明了数据库存储的安全性问题日显突出。论文首先介绍了数据库存储安全的现状,区分了MD5的碰撞性在算法与在应用上的根本区别。然后,指出了传统MD5哈希算法与加盐哈希算法在某些应用场景下的误区,总结了安全的加盐哈希算法应用。最后,通过PBKDF2迭代算法对加盐哈希算法应用流程进行优化,利用Python编程还原哈希过程,并通过测试验证了该种慢速哈希算法的应用,可以使利用高性能硬件进行字典或者暴力破解的速度慢到没有实用价值。With the rapid development of information technology, Application database are more widely. But recent such as CSDN, even millet forum, home Hanting involved data leakage problems, it showed a significant outstanding safety issues with date database storage. This paper describes the status of the database storage security and distinction between the MD5 collision of fundamental differences in the algorithms and the application. Then, noting the traditional salted MD5 hash algorithm and hash algorithm errors in certain scenarios, summarized the safety salted hash algorithm used. Finally, improving the salt hash function by using PBKDF2 to iterative algorithm and using python programming to restore thehash process and validation this kind of slow hash algorithm applications can make the hash function very slow, so that even with a fast custom hardware, dictionary and brute-force attacks are too slow to be worthwhile.

关 键 词：数据库 安全 哈希算法 SHA256 PBKDF2 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]