如何在 C# 中使用 SHA1 或 MD5？（哪个在性能和安全性方面更好进行身份验证）
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1756188/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to Use SHA1 or MD5 in C#?(Which One is Better in Performance and Security for Authentication)
提问by Sajad Bahmani
In C# how we can use SHA1 automatically?
Is SHA1 better than MD5?(We use hashing for user name and password and need speed for authentication)
在 C# 中，我们如何自动使用 SHA1？
SHA1 比 MD5 更好吗？（我们对用户名和密码使用散列，需要速度进行身份验证）
采纳答案by Kyle Rozendo
Not sure what you mean by automatically, but you should really use SHA256and higher. Also alwaysuse a Salt(code) with your hashes. A side note, after time has passed, using hardened hashes is far better than using a plain speed-based hashing function. I.e.: hashing over a few hundred iterations, or using already proven hashing functions such as bcrypt(which is mentioned below I believe). A code sample for using a SHA256 hash function in .NET is as follows:
不确定您所说的自动是什么意思，但您应该真正使用SHA256和更高。也总是在你的散列中使用盐（代码）。附带说明，经过一段时间后，使用强化散列比使用简单的基于速度的散列函数要好得多。即：散列数百次迭代，或使用已经证明的散列函数，例如bcrypt（我相信在下面提到）。在.NET中使用SHA256哈希函数的代码示例如下：
byte[] data = new byte[DATA_SIZE];
byte[] result;
using(SHA256 shaM = new SHA256Managed()) {
result = shaM.ComputeHash(data);
}
Will do the trick for you using SHA256 and is found at MSDN.
将使用 SHA256 为您解决问题，可在MSDN上找到。
Sidenote on the "cracking" of SHA1: Putting the cracking of SHA-1 in perspective
关于 SHA1 的“破解”的旁注：透视 SHA-1 的破解
回答by Ahmed Said
回答by Darin Dimitrov
SHA1 is stronger than MD5 so if you have the choice it would be better to use it. Here's an example:
SHA1 比 MD5 更强，因此如果您有选择，最好使用它。下面是一个例子：
public static string CalculateSHA1(string text, Encoding enc)
{
byte[] buffer = enc.GetBytes(text);
SHA1CryptoServiceProvider cryptoTransformSHA1 = new SHA1CryptoServiceProvider();
return BitConverter.ToString(cryptoTransformSHA1.ComputeHash(buffer)).Replace("-", "");
}
回答by Dragontamer5788
Both are too fast to be used, directly at least. Use Key Strengthening to "slow down" the password hashing procedure. Speed is the unfortunately the enemy to password security.
两者都太快了，至少不能直接使用。使用密钥强化来“减慢”密码散列过程。不幸的是，速度是密码安全的敌人。
How slow is slow enough? Slowing down a password hash from ~microseconds to ~hundreds of milliseconds will not adversely affect the perceived performance of your application... but will make cracking passwords literally a hundred thousand times slower.
多慢才够慢？将密码哈希从~微秒减慢到~数百毫秒不会对应用程序的感知性能产生不利影响......但会使破解密码的速度慢十万倍。
View this article for details: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html
详情查看这篇文章：http: //chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html
The problem is that MD5 is fast. So are its modern competitors, like SHA1 and SHA256. Speed is a design goal of a modern secure hash, because hashes are a building block of almost every cryptosystem, and usually get demand-executed on a per-packet or per-message basis.
Speed is exactly what you don't want in a password hash function.
问题是 MD5 速度很快。它的现代竞争对手也是如此，例如 SHA1 和 SHA256。速度是现代安全散列的设计目标，因为散列是几乎每个密码系统的构建块，并且通常在每个数据包或每个消息的基础上按需执行。
速度正是您在密码哈希函数中不想要的。
... snip ...
……剪……
The password attack game is scored in time taken to crack password X. With rainbow tables, that time depends on how big your table needs to be and how fast you can search it. With incremental crackers, the time depends on how fast you can make the password hash function run.
密码攻击游戏是在破解密码 X 所用的时间内计分的。对于彩虹桌，该时间取决于您的桌子需要多大以及您可以多快地搜索它。对于增量破解程序，时间取决于您可以使密码哈希函数运行的速度。
That said, use BCrypt. SCrypt was recently developed, but I doubt that any stable (or production ready) libraries exist for it yet. Theoretically, SCrypt claims to improve upon BCrypt. "Building your own" is not recommended, but iterating MD5 / SHA1 / SHA256 thousands of times ought to do the trick (ie: Key Strengthening).
也就是说，使用 BCrypt。SCrypt 是最近开发的，但我怀疑是否存在任何稳定（或生产就绪）的库。从理论上讲，SCrypt 声称改进了 BCrypt。不建议“构建自己的”，但迭代 MD5/SHA1/SHA256 数千次应该可以解决问题（即：密钥强化）。
And in case you don't know about them, be sure to read up on Rainbow Tables. Basic security stuff.
如果您不了解它们，请务必阅读 Rainbow Tables。基本安全的东西。
回答by Anuradha Jayasena
use SHA1 or SHA2 The MD5 algorithm is problematic.
使用 SHA1 或 SHA2 MD5 算法是有问题的。
http://userpages.umbc.edu/~mabzug1/cs/md5/md5.htmlhttp://msdn.microsoft.com/en-us/library/system.security.cryptography.md5%28v=vs.85%29.aspx
http://userpages.umbc.edu/~mabzug1/cs/md5/md5.htmlhttp://msdn.microsoft.com/en-us/library/system.security.cryptography.md5%28v=vs.85% 29.aspx
回答by wener
I'd like use these things.
我想用这些东西。
MD5, SHA1/256/384/512 with an optional Encoding parameter.
MD5、SHA1/256/384/512 带有可选的编码参数。
Othere HashAlgorithms.Thanks to Darin Dimitrov.
其他哈希算法。感谢Darin Dimitrov。
public static string MD5Of(string text)
{
return MD5Of(text, Encoding.Default);
}
public static string MD5Of(string text, Encoding enc)
{
return HashOf<MD5CryptoServiceProvider>(text, enc);
}
public static string SHA1Of(string text)
{
return SHA1Of(text, Encoding.Default);
}
public static string SHA1Of(string text, Encoding enc)
{
return HashOf<SHA1CryptoServiceProvider>(text, enc);
}
public static string SHA384Of(string text)
{
return SHA384Of(text, Encoding.Default);
}
public static string SHA384Of(string text, Encoding enc)
{
return HashOf<SHA384CryptoServiceProvider>(text, enc);
}
public static string SHA512Of(string text)
{
return SHA512Of(text, Encoding.Default);
}
public static string SHA512Of(string text, Encoding enc)
{
return HashOf<SHA512CryptoServiceProvider>(text, enc);
}
public static string SHA256Of(string text)
{
return SHA256Of(text, Encoding.Default);
}
public static string SHA256Of(string text, Encoding enc)
{
return HashOf<SHA256CryptoServiceProvider>(text, enc);
}
public static string HashOf<TP>(string text, Encoding enc)
where TP: HashAlgorithm, new()
{
var buffer = enc.GetBytes(text);
var provider = new TP();
return BitConverter.ToString(provider.ComputeHash(buffer)).Replace("-", "");
}
回答by Biswajit Karmakar
MD5 is better in performance and SHA1 is better for security. You can get an idea from this comparison
MD5 的性能更好，SHA1 的安全性更好。你可以从这个比较中得到一个想法
