我的同事有一个存储帐户信息的数据库；帐户的SHA256散列密码和salt值作为原始二进制数据（blob）存储在列中。
密码在PHP中使用以下方式进行散列（true表示原始输出）：
hash("sha256", $salt . $password, true);
我试图在Node.js服务器上实现身份验证，该服务器必须从PHP获取存储在数据库中的相同哈希密码，这似乎不起作用：
/**
* Validates a password sent by an end user by comparing it to the
* hashed password stored in the database. Uses the Node.js crypto library.
*
* @param password The password sent by the end user.
* @param dbPassword The hashed password stored in the database.
* @param dbSalt The encryption salt stored in the database.
*/
function validatePassword(password, dbPassword, dbSalt) {
// Should the dbSalt be a Buffer, hex, base64, or what?
var hmac = crypto.createHmac("SHA256", dbSalt);
var hashed = hmac.update(password).digest('base64');
console.log("Hashed user password: " + hashed);
console.log("Database password: " + dbPassword.toString('base64'));
return hashed === dbPassword;
}
经过大量的实验，我找到了一个解决方案。
/**
* Encrypts a password using sha256 and a salt value.
*
* @param password The password to hash.
* @param salt The salt value to hash with.
*/
function SHA256Encrypt(password, salt) {
var saltedpassword = salt + password;
var sha256 = crypto.createHash('sha256');
sha256.update(saltedpassword);
return sha256.digest('base64');
}
/**
* Validates a password sent by an end user by comparing it to the
* hashed password stored in the database.
*
* @param password The password sent by the end user.
* @param dbPassword The hashed password stored in the database, encoded in Base64.
* @param dbSalt The encryption salt stored in the database. This should be a raw blob.
*/
function validatePassword(password, dbPassword, dbSalt) {
var hashed = SHA256Encrypt(password, dbSalt.toString('binary'));
return hashed === dbPassword;
}
不过，多亏了TravisO，他让我走上了正确的道路。
crypto.createHash（）
http://nodejs.org/docs/v0.6.18/api/crypto.html#crypto_crypto_createhash_algorithm
只要确保你使用完全相同的哈希类型和盐。