sql - AdventureWorks2012 DB - 如何存储密码以及如何验证密码？

Question

我从http://msftdbprodsamples.codeplex.com/releases/view/55330获得 AdventureWorks2012 DB，并尝试从 Person.Password 表中验证密码。“PasswordHash”列描述为“电子邮件帐户的密码”。并且“PasswordSalt”列描述显示“在对密码进行哈希处理之前与密码字符串连接的随机值”。

以下是数据库中的示例数据：

BusinessEntityID, PasswordHash, PasswordSalt, EmailAddress
---------------- --------------------------------------------------------------------------
1, pbFwXWE99vobT6g+vPWFy93NtUU/orrIWafF01hccfM=, bE3XiWw=, ken0@adventure-works.com

2, bawRVNrZQYQ05qF05Gz6VLilnviZmrqBReTTAGAudm0=, "EjJaC3U=, terri0@adventure-works.com

我如何知道使用哪种哈希算法来创建 PasswordHash？以及密码盐是如何生成的？

这是尝试验证密码的代码，但没有一个哈希算法起作用。任何人都可以对此有所了解吗？

public class SecurityService : ISecurityService
    {
        public string UserName { get; set; }

        public bool ValidateCredentials(string password, Password dbPassword)
        {
            bool valid = false;

            byte[] saltBytes = Convert.FromBase64String(dbPassword.PasswordSalt); //dbPassword.PasswordSalt: bE3XiWw=
            byte[] passwordBytes = Encoding.Unicode.GetBytes(password); //password: ken0@adventure-works.com
            byte[] passwordHashBytes = Convert.FromBase64String(dbPassword.PasswordHash);//dbPassword.PasswordHash: pbFwXWE99vobT6g+vPWFy93NtUU/orrIWafF01hccfM=
            byte[] passwordHashed    = Hash(passwordBytes, saltBytes);
            byte[] dbPasswordHashed  = Hash(passwordHashBytes, saltBytes);

            valid = dbPasswordHashed.SequenceEqual(passwordHashed);

            return valid;

        }

        private static byte[] Hash(byte[] value, byte[] salt)
        {
            byte[] saltedValue = value.Concat(salt).ToArray();
            return HashAlgorithm.Create("MD5").ComputeHash(saltedValue);
            //return HashAlgorithm.Create("SHA1").ComputeHash(saltedValue);
            //return HashAlgorithm.Create("SHA256").ComputeHash(saltedValue);
            //return HashAlgorithm.Create("SHA384").ComputeHash(saltedValue);
            //return HashAlgorithm.Create("SHA512").ComputeHash(saltedValue);  
        }
    }

Answer 1

如果替换 valid = dbPasswordHashed.SequenceEqual(passwordHashed); 有效 = passwordHashBytes.SequenceEqual(passwordHashed);

它会给出正确的结果。