Question

我找到了pbkdf2散列算法的实现，我可以计算散列，但我不知道如果我登录的话我怎么能比较哈希和密码。有人可以给我一个暗示吗？这是我对哈希算法的实现

#import <CommonCrypto/CommonKeyDerivation.h>

...

// Makes a random 256-bit salt
- (NSData*)generateSalt256 {
    unsigned char salt[32];
for (int i=0; i<32; i++) {
    salt[i] = (unsigned char)arc4random();
}
return [NSData dataWithBytes:salt length:32];
}

...

// Make keys!
NSString* myPass = @"MyPassword1234";
NSData* myPassData = [myPass dataUsingEncoding:NSUTF8StringEncoding];
NSData* salt = [self generateSalt256];

// How many rounds to use so that it takes 0.1s ?
int rounds = CCCalibratePBKDF(kCCPBKDF2, myPassData.length, salt.length, kCCPRFHmacAlgSHA256, 32, 100);

// Open CommonKeyDerivation.h for help
unsigned char key[32];
CCKeyDerivationPBKDF(kCCPBKDF2, myPassData.bytes, myPassData.length, salt.bytes, salt.length,     kCCPRFHmacAlgSHA256, rounds, key, 32);

Answer 1

PBKDF2通常用于从您的密码生成加密密钥;它不像你使用MD5那样用于哈希。你是如何使用它登录的？类似LastPass的内容？

通常，将密码（在salt和hash之后）发送到服务器，服务器进行比较，而不是客户端。你有不同的用例吗？

pbkdf2 objective c比较哈希值

1 个答案: