2

我的同事有一个存储帐户信息的数据库；帐户的 SHA256 哈希密码和盐值作为原始二进制数据 (blob) 存储在列中。

密码在 PHP 中使用它进行哈希处理（true 表示原始输出）：

hash("sha256", $salt . $password, true);

我正在尝试在必须从 PHP 取回存储在数据库中的相同哈希密码的 Node.js 服务器上实现身份验证，这似乎不起作用：

/**
 * Validates a password sent by an end user by comparing it to the 
 * hashed password stored in the database. Uses the Node.js crypto library.
 *
 * @param password The password sent by the end user.
 * @param dbPassword The hashed password stored in the database.
 * @param dbSalt The encryption salt stored in the database.
 */
function validatePassword(password, dbPassword, dbSalt) {
    // Should the dbSalt be a Buffer, hex, base64, or what?
    var hmac = crypto.createHmac("SHA256", dbSalt);
    var hashed = hmac.update(password).digest('base64');
    console.log("Hashed user password: " + hashed);
    console.log("Database password: " + dbPassword.toString('base64'));
    return hashed === dbPassword;
}
4

2 回答 2

5

经过大量的实验，我找到了解决方案。

/**
 * Encrypts a password using sha256 and a salt value.
 *
 * @param password The password to hash.
 * @param salt The salt value to hash with.
 */
function SHA256Encrypt(password, salt) {
    var saltedpassword = salt + password;
    var sha256 = crypto.createHash('sha256');
    sha256.update(saltedpassword);
    return sha256.digest('base64');
}

/**
 * Validates a password sent by an end user by comparing it to the
 * hashed password stored in the database.
 *
 * @param password The password sent by the end user.
 * @param dbPassword The hashed password stored in the database, encoded in Base64.
 * @param dbSalt The encryption salt stored in the database. This should be a raw blob.
 */
function validatePassword(password, dbPassword, dbSalt) {
    var hashed = SHA256Encrypt(password, dbSalt.toString('binary'));
    return hashed === dbPassword;
}

不过，多亏了 TravisO，他让我走上了正确的道路。

于 2013-06-20T20:09:05.877 回答
2

crypto.createHash()

http://nodejs.org/docs/v0.6.18/api/crypto.html#crypto_crypto_createhash_algorithm

只要绝对确保您使用完全相同的散列类型和盐。

于 2013-06-20T18:25:17.703 回答