SHA256 是否被认为不安全？- SonarQube 质量门 - 我该如何解决？

Question

I have below piece of code

        private static string sensitiveKey = "<REPLACE_WITH_KEY>"  

        public static string Encrypt(string input)
        {
            // Get the bytes of the string
            byte[] passwordBytes = Encoding.UTF8.GetBytes(sensitiveKey);
            // Hash the password with SHA256
            passwordBytes = SHA256.Create().ComputeHash(passwordBytes);
            byte[] bytesEncrypted = EncryptStringToBytes_Aes(input, passwordBytes);
            string result = Convert.ToBase64String(bytesEncrypted);
            return result;
        }

SonarQube says

Cryptographic hash functions are used to uniquely identify information without storing their original form. When not done properly, an attacker can steal the original information by guessing it (ex: with a rainbow table), or replace the original data with another one having the same hash.

Also

use only hashing algorithms which are currently known to be strong. Avoid using algorithms like MD5 and SHA1 completely in security contexts.

So question is, How can I improve my code so that it can be secure?

Any samples out thr?

Answer 1

You could try adding a salt to the hashed password since unsalted hashes tend to be more vulnerable to dictionary and rainbow table attacks.

hash("hello") =
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

hash("hello" + "QxLUF1bgIAdeQX") = 
9e209040c863f84a31e719795b2577523954739fe5ed3b58a75cff2127075ed1

hash("hello" + "bv5PehSMfV11Cd") = 
d1d3ec2e6f20fd420d50e2642992841d8338a314b8ea157c9e18477aaef226ab

The code above is an example of how salting usually works. You concatenate a fixed string to the password and then hash the result. The salt should be of fixed length and should never be reused . This is how it could look like in your case:

        private static string salt = "<REPLACE_WITH_FIXED_LENGTH_SALT>";
        private static string sensitiveKey = "<REPLACE_WITH_KEY>";  
        private static string salted_key = salt + sensitiveKey;

        public static string Encrypt(string input)
        {
            // Get the bytes of the string
            byte[] passwordBytes = Encoding.UTF8.GetBytes(salted_key);
            // Hash the password with SHA256
            passwordBytes = SHA256.Create().ComputeHash(passwordBytes);
            byte[] bytesEncrypted = EncryptStringToBytes_Aes(input, passwordBytes);
            string result = Convert.ToBase64String(bytesEncrypted);
            return result;
        }