從SQLServer資料庫中檢索條目的C#HASH演算法邏輯-有解無憂

我一直在努力解決這個問題的邏輯以及如何讓 HASH 演算法檢查從 SQL Server 資料庫中檢索到的條目是否與用戶輸入的條目相匹配。

下面的代碼確實有效，我無法理解的是從 SQL Server 資料庫中檢索到的欄位應該在代碼中的位置以及它如何與用戶輸入的條目匹配。

下面的代碼確實包含用于保存修改后的 HASH 條目的代碼。

SQL Server 資料庫中的條目保存為Varbinary

'0xD94C0F10760D83BC35C0786C674B5F8F'

任何幫助將非常感激。

    string[] passwordargs = new string[] { "turkey", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat" };
        //If no file name is specified, write usage text.
        if (passwordargs.Length == 0)
        {
            Console.WriteLine(usageText);
        }
        else
        {
            string pwd1 = passwordargs[0];
            // Create a byte array to hold the random value.
            byte[] salt1 = new byte[8];
            using (RNGCryptoServiceProvider rngCsp = new RNGCryptoServiceProvider())
            {
                // Fill the array with a random value.
                rngCsp.GetBytes(salt1);
            }

            //data1 can be a string or contents of a file.
            string data1 = "Some test data";
            //The default iteration count is 1000 so the two methods use the same iteration count.
            int myIterations = 1000;
            try
            {
                Rfc2898DeriveBytes k1 = new Rfc2898DeriveBytes(pwd1, salt1, myIterations);
                Rfc2898DeriveBytes k2 = new Rfc2898DeriveBytes(pwd1, salt1);
                // Encrypt the data.
                Aes encAlg = Aes.Create();
                encAlg.Key = k1.GetBytes(16);
                MemoryStream encryptionStream = new MemoryStream();
                CryptoStream encrypt = new CryptoStream(encryptionStream, encAlg.CreateEncryptor(), CryptoStreamMode.Write);
                byte[] utfD1 = new System.Text.UTF8Encoding(false).GetBytes(data1);

                encrypt.Write(utfD1, 0, utfD1.Length);
                encrypt.FlushFinalBlock();
                encrypt.Close();
                byte[] edata1 = encryptionStream.ToArray();
                string encryptString = Convert.ToBase64String(edata1.ToArray());

                string queryStmt = "UPDATE [dbo].[Staff] SET [MEMWORD] = (@Content) WHERE STAFF_ID=7";

                using (SqlConnection _con = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["AppDb"].ConnectionString))
                using (SqlCommand _cmd = new SqlCommand(queryStmt, _con))
                {
                    SqlParameter param = _cmd.Parameters.Add("@Content", SqlDbType.VarBinary);
                    param.Value = edata1;

                    _con.Open();
                    _cmd.ExecuteNonQuery();
                    _con.Close();
                }

                k1.Reset();

                // Try to decrypt, thus showing it can be round-tripped.
                Aes decAlg = Aes.Create();
                decAlg.Key = k2.GetBytes(16);
                decAlg.IV = encAlg.IV;
                MemoryStream decryptionStreamBacking = new MemoryStream();
                CryptoStream decrypt = new CryptoStream(decryptionStreamBacking, decAlg.CreateDecryptor(), CryptoStreamMode.Write);
                decrypt.Write(edata1, 0, edata1.Length);
                decrypt.Flush();
                decrypt.Close();
                k2.Reset();
                string data2 = new UTF8Encoding(false).GetString(decryptionStreamBacking.ToArray());

                if (!data1.Equals(data2))
                {
                    Console.WriteLine("Error: The two values are not equal.");
                }
                else
                {
                    Console.WriteLine("The two values are equal.");
                    Console.WriteLine("k1 iterations: {0}", k1.IterationCount);
                   

                    Console.WriteLine("k2 iterations: {0}", k2.IterationCount);
                }
            }
            catch (Exception e)
            {
                Console.WriteLine("Error: {0}", e);
                string error = e.ToString();
            }
        }

uj5u.com熱心網友回復：

你的意思是

下面的代碼確實有效......

if (!data1.Equals(data2))當您期望它相等時是否相等？

在我的理解中，你設定data1 = "Some test data"了，直到我們到達終點才會改變。

因為data2它需要做更多的作業，但要從上到下分解：

存盤data1為utfD1UTF-8 位元組陣列 -> byte[] utfD1 = new System.Text.UTF8Encoding(false).GetBytes(data1);
寫入utfD1流encrypt（encryptionStream是 CryptoStream 的底層流）->encrypt.Write(utfD1, 0, utfD1.Length);
寫入encryptionStreamintedata1位元組陣列 ->byte[] edata1 = encryptionStream.ToArray();
寫入（因為它的底層流edata1）->decryptionStreamBackingdecryptdecrypt.Write(edata1, 0, edata1.Length);
decryptionStreamBacking解碼 UTF-8 位元組陣列并將其存盤在data2->
string data2 = new UTF8Encoding(false).GetString(decryptionStreamBacking.ToArray());

所以對我來說，這看起來像是一種花哨的說法string data2 = data1，并且資料庫是一個只寫的場景。您只更新資料庫中的一個值，但不會從中讀取任何內容。

uj5u.com熱心網友回復：

感謝您的所有幫助和建議，我們現在已經完成了作業代碼。

我們不得不改變 byte[] salt1 = new byte[8]; 到 byte[] salt1 = new byte[]{0, 1, 2, 3, 4, 5, 6, 7};

否則 salt1 每次都會不同，這將創建不同的加密，這將不允許輸入的密碼與資料庫中保存的密碼配對。

謝謝大家的意見。

 byte[] returned_Data;
 string[] passwordargs = new string[] { "turkey", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat" };
 //If no file name is specified, write usage text.
 if (passwordargs.Length == 0)
 {
 Console.WriteLine(usageText);
 }
 else
 {
 string pwd1 = passwordargs[0];
 byte[] salt1 = new byte[]{0,1 ,2, 3,4, 5,6, 7};
 using (RNGCryptoServiceProvider rngCsp = new
RNGCryptoServiceProvider())
 {
 // Fill the array with a random value.
 rngCsp.GetBytes(salt1);
 }

 //data1 can be a string or contents of a file.
 string data1 = "Some test data";
 //The default iteration count is 1000 so the two methods use the same iteration count.
 int myIterations = 1000;
 try
 {
 Rfc2898DeriveBytes k1 = new Rfc2898DeriveBytes(pwd1, salt1,myIterations);
 Rfc2898DeriveBytes k2 = new Rfc2898DeriveBytes(pwd1, salt1);
 // Encrypt the data.
 Aes encAlg = Aes.Create();
  encAlg.Key = k1.GetBytes(16);
 MemoryStream encryptionStream = new MemoryStream();
 CryptoStream encrypt = new CryptoStream(encryptionStream,
 encAlg.CreateEncryptor(), CryptoStreamMode.Write);
 byte[] utfD1 = new System.Text.UTF8Encoding(false).GetBytes(
data1);

 encrypt.Write(utfD1, 0, utfD1.Length);
 encrypt.FlushFinalBlock();
 encrypt.Close();
 byte[] edata1 = encryptionStream.ToArray();
                
 string queryStmt = "UPDATE [dbo].[Staff] SET [PASSWORD] = (@Content) WHERE STAFF_ID=7";

 using (SqlConnection _con = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["Conn"].ConnectionString))
 using (SqlCommand _cmd = new SqlCommand(queryStmt, _con))
 {
 SqlParameter param = _cmd.Parameters.Add("@Content", SqlDbType.VarBinary);
 param.Value = edata1;

 _con.Open();
 _cmd.ExecuteNonQuery();
 _con.Close();
 }


 using (SqlConnection sqlconnection = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["Conn"].ConnectionString))
 {
 sqlconnection.Open();

 string selectQuery = string.Format(@"Select [PASSWORD] From [dbo].[Staff] Where STAFF_ID={0}", 7);

 SqlCommand selectCommand = new SqlCommand(selectQuery, sqlconnection);
 SqlDataReader reader = selectCommand.ExecuteReader();
 if (reader.Read())
 {
 returned_Data = (byte[])reader[0];
 string strData = Encoding.UTF8.GetString(returned_Data);
 Console.WriteLine(strData);

  if(!edata1.SequenceEqual(returned_Data))
 {
 Console.WriteLine("Error: The two values are not equal.");
 }
 else
 {
 Console.WriteLine("The two values are equal.");
 Console.WriteLine("k1 iterations: {0}", k1.IterationCount);


Console.WriteLine("k2 iterations: {0}", k2.IterationCount);
                        }
                    }
                }

轉載請註明出處，本文鏈接：https://www.uj5u.com/houduan/463765.html

標籤：C＃ sql服务器算法安全哈希

上一篇：這個偽代碼的復雜度（?）是多少？

下一篇：烏龜穿越自己的路徑謎題/演算法