C＃哈希密码创建盐问题

Question

If I create salt by using something like this:

public class User
    {
        private const int Hash_Salt_Length = 8;
        private byte[] saltBytes = new byte[Hash_Salt_Length];


        public User()
        {
            RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
            rng.GetNonZeroBytes(saltBytes);     
        }
        ....

}

The saltBytes bytes array will be different for each session (restart the application). How can I check password to allow user login our application?

Answer 1

You need to store the salt in the database, along with the password hash.

Note that you shouldn't be calling GetNonZeroBytes , as that provides less randomness.

Answer 2

如果每次重新启动应用程序时盐值都发生变化，则必须将其存储在数据库中（在用户记录中）。

Answer 3

The salt is a static thing that you generate when you create you user record, and you store it along with the user ID and the hash of the password + salt.

When the user tries to logon, you use the ID to lookup the salt, combine that with their password, hash it and compare to the stored hash. If they match, they're in.

The salt exists so that an attacker with access to your security database cannot pre-prepare a database of password -> hash mappings, and then perform simple reverse lookups to try to determine passwords.