详细说明对密码执行散列与 salt 运算方法

hashedPassword.Length != storedPassword.Length - saltLength)
                     {
                            return false;
                     }
 
                     //获取数据库中的密码的salt 值，数据库中的密码的后4个字节为salt 值
                     byte[] saltValue = new byte[saltLength];
                     int saltOffset = storedPassword.Length - saltLength;
                     for (int i = 0; i < saltLength; i++){
                            saltValue[i] = storedPassword[saltOffset + i];
                     }
                    
                     //用户输入的密码用户输入的密码加上salt 值，进行salt
                     byte[] saltedPassword = CreateSaltedPassword(saltValue, hashedPassword);
             
                     //比较数据库中的密码和经过salt的用户输入密码是否相等
                     return CompareByteArray(storedPassword, saltedPassword);
              }
 
              /// <summary>
              /// 比较两个ByteArray，看是否相等
              /// </summary>
              /// <param name="array1"></param>
              /// <param name="array2"></param>
              /// <returns>true：相等/false：不等</returns>
              private static bool CompareByteArray(byte[] array1, byte[] array2)
              {
                     if (array1.Length != array2.Length)
                     {
                            return false;
                     }
                     for (int i = 0; i < array1.Length; i++)
                     {
                            if (array1[i] != array2[i])
                            {
                                   return false;
                            }
                     }
                     return true;
              }
 
              /// <summary>
              /// 对要存储的密码进行salt运算
              /// </summary>
              /// <param name="unsaltedPassword">没有进行过salt运算的hash散列密码</param>
              /// <returns>经过salt的密码（经过salt的密码长度为：20+4=24，存储密码的字段为Binary(24)）</returns>
              private static byte[] CreateDbPassword(byte[] unsaltedPassword)
              {
                     //获得 salt 值
                     byte[] saltValue = new byte[saltLength];
                     RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
                     rng.GetBytes(saltValue);
                    
                     return CreateSaltedPassword(saltValue, unsaltedPassword);
              }
             
              /// <summary>
              /// 创建一个经过salt的密码
              /// </summary>
              /// <param name="saltValue">salt 值</param>
              /// <param name="unsaltedPassword">没有进行过salt运算的hash散列密码</param>
              /// <returns>经过salt的密码</returns>
              private static byte[] CreateSaltedPassword(byte[] saltValue, byte[] unsaltedPassword)
              {
                     //将salt值数组添加到hash散列数组后拼接成rawSalted数组中
                     byte[] rawSalted  = new byte[unsaltedPassword.Length + saltValue.Length];
                     unsaltedPassword.CopyTo(rawSalted,0);
                     saltValue.CopyTo(rawSalted,unsaltedPassword.Length);
                    
                     //将合并后的rawSalted数组再进行SHA1散列的到saltedPassword数组（长度为20字节）
                     SHA1 sha1 = SHA1.Create();
                     byte[] saltedPassword = sha1.ComputeHash(rawSalted);
 
                     //将salt值数组在添加到saltedPassword数组后拼接成dbPassword数组（长度为24字节）
                     byte[] dbPassword  = new byte[saltedPassword.Length + saltValue.Length];
                     saltedPassword.CopyTo(dbPassword,0);
                     saltValue.CopyTo(dbPassword,saltedPassword.Length);
 
                     return dbPassword;
              }
 
       }
}

关键词：详细说明对密码执行散列与 salt 运算办法